permdock 0.5.0 → 0.7.0

package/dist/powersync-53ryOZip.js

@@ -0,0 +1,1059 @@
+import { t as compact } from "./compact-CAf557ZB.js";
+import { c as isConditionDate, l as isConditionRef } from "./refs-CNJBiTFo.js";
+import { A as memoryCustomRoleSource, g as localSnapshotManifest } from "./src-DLFrtrrC.js";
+import { n as findPermission } from "./permission-registry-DpPtSKNZ.js";
+import { f as scopeList, s as resolveScope } from "./scopes-BHsc-wp-.js";
+import { c as policyLevels } from "./policy-DaJy4nK4.js";
+import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
+import { t as getPermDock } from "./permdock-BfWEeMqk.js";
+import { u as usageResult } from "./errors-DpP_U6Bf.js";
+import { c as requirePolicy } from "./load-DxroEzH1.js";
+import { s as quoteSqlLiteral, t as SQL_IDENT } from "./sql-B96movIM.js";
+import { i as scopeMembershipTable, r as scopeColumn } from "./compile-BAEO5bOk.js";
+import "./sources-B-zYB4GS.js";
+import { t as applyFiles } from "./files-acUbNwWt.js";
+import { i as fileDrift } from "./output-files-CCMdcFWb.js";
+import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-BTMW6zgU.js";
+import { O as quoteIdent, a as customRolesOn, t as CUSTOM_ROLES } from "./shared-fMKOv8hP.js";
+import { F as collectGrants, I as roleNames, L as andConditions, M as assignableRoles, t as ownershipRules, z as contextRefs } from "./ownership-Z2LpxsGa.js";
+import { t as membershipSourcesOf } from "./sources-qoIJQrJv.js";
+import { f as pgConnector } from "./policies-B2lZIurj.js";
+import { d as tableNames, t as canFixture, x as tableFor } from "./verify-pe8rL_Qw.js";
+import { resolve } from "node:path";
+//#region src/cli/powersync/names.ts
+function ident(name) {
+	if (!SQL_IDENT.test(name)) throw new TypeError(`PermDock CLI: '${name}' is not a plain identifier, which Sync Streams need`);
+	return name;
+}
+function parts(table) {
+	const dot = table.lastIndexOf(".");
+	const schema = dot === -1 ? void 0 : ident(table.slice(0, dot));
+	const name = ident(table.slice(dot + 1));
+	return [schema === "public" ? void 0 : schema, name];
+}
+/**
+* The name a stream query and the device use for the table: its own name,
+* or `<schema>_<table>` for a table outside `public` that shares its name
+* with another synced table, since PowerSync drops the schema on the device.
+*/
+function bare(table, named) {
+	const [schema, name] = parts(table);
+	const key = `${schema ?? "public"}.${name}`;
+	named.names?.seen.add(key);
+	return named.names?.renamed.get(key) ?? name;
+}
+/** The table as a stream query reads it: Sync Streams need a schema other than `public` in double quotes. */
+function quotedTable(table) {
+	const [schema, name] = parts(table);
+	return schema === void 0 ? name : `"${schema}"."${name}"`;
+}
+/** The table in a `FROM` or `JOIN`, aliased to its `bare` name outside `public`. */
+function fromTable(table, named) {
+	const [schema] = parts(table);
+	return schema === void 0 ? bare(table, named) : `${quotedTable(table)} AS ${bare(table, named)}`;
+}
+/** `<schema>_<table>` for each table outside `public` whose name another referenced table shares. */
+function renames(seen) {
+	const byName = /* @__PURE__ */ new Map();
+	for (const table of seen) {
+		const name = table.slice(table.indexOf(".") + 1);
+		byName.set(name, [...byName.get(name) ?? [], table]);
+	}
+	const out = /* @__PURE__ */ new Map();
+	for (const tables of byName.values()) {
+		if (tables.length < 2) continue;
+		for (const table of tables) if (!table.startsWith("public.")) out.set(table, table.replace(".", "_"));
+	}
+	return out;
+}
+/** The role label of a custom role's grants in warnings and gaps. */
+const CUSTOM_ROLE = "custom role";
+//#endregion
+//#region src/cli/powersync/sources.ts
+/** The sources that can hold scope `name`: every table source and the junction sources of that scope. */
+function scopeSourcesOf(sources, name) {
+	return sources.filter((source) => source.sql.scope === void 0 || source.sql.scope === name);
+}
+/** The source's stream form, or why its rows cannot filter a stream. */
+function streamOf(source) {
+	const { stream } = source.sql;
+	if (stream === void 0) return `the ${source.sql.table} membership source has no stream form: build it with tableMembershipSource or junctionMembershipSource`;
+	if (stream.expiresAt !== void 0) return `the ${stream.table} membership source has no stream: it has an expiry`;
+	if (stream.disabledAt !== void 0) return `the ${stream.table} membership source has no stream: it has disabledAt`;
+	return stream;
+}
+function pairOf(through) {
+	const [pair] = Object.entries(through.on);
+	if (pair === void 0) throw new TypeError(`PermDock CLI: the reference to ${through.through} names no column`);
+	return pair;
+}
+function isFixed(roles) {
+	return typeof roles === "object" && "value" in roles;
+}
+function isSourceList(roles) {
+	return Array.isArray(roles);
+}
+function roleSources(roles) {
+	return isSourceList(roles) ? roles : [roles];
+}
+function anyOf(clauses) {
+	return clauses.length === 1 ? clauses[0] ?? "" : `(${clauses.join(" OR ")})`;
+}
+/** The user's own rows of the source, of scope `scope` when the source has a scope column. */
+function ownRows(stream, dialect, scope) {
+	const table = bare(stream.table, dialect);
+	const scoped = scope !== void 0 && "column" in stream.scope ? [`${dialect.column(table, stream.scope.column)} = ${dialect.literal(scope)}`] : [];
+	if (typeof stream.user === "string") return {
+		table,
+		from: fromTable(stream.table, dialect),
+		where: [`${dialect.column(table, stream.user)} = ${dialect.user}`, ...scoped]
+	};
+	const users = bare(stream.user.through, dialect);
+	const [ref, id] = pairOf(stream.user);
+	return {
+		table,
+		from: `${fromTable(stream.table, dialect)} INNER JOIN ${fromTable(stream.user.through, dialect)} ON ${dialect.column(users, id)} = ${dialect.column(table, ref)}`,
+		where: [`${dialect.column(users, stream.user.column)} = ${dialect.user}`, ...scoped]
+	};
+}
+/** The filter of one role source for role `role`; `undefined` when the source never holds it. */
+function roleFilter(stream, source, role, table, dialect) {
+	if (typeof source === "string") return {
+		join: "",
+		where: `${dialect.column(table, source)} = ${dialect.literal(role)}`
+	};
+	if ("map" in source) {
+		const values = Object.entries(source.map).filter(([, key]) => key === role).map(([value]) => `${dialect.column(table, source.column)} = ${dialect.literal(value)}`);
+		return values.length === 0 ? void 0 : {
+			join: "",
+			where: anyOf(values)
+		};
+	}
+	const keys = bare(source.through, dialect);
+	const [ref, id] = pairOf(source);
+	const { guard } = stream;
+	const guarded = guard !== void 0 && bare(guard.table, dialect) === keys && guard.declared.includes(role) ? [anyOf([`${dialect.column(keys, guard.tenant)} IS NULL`, ...guard.skip === void 0 ? [] : [`${dialect.column(keys, guard.skip)} = ${dialect.literal(true)}`]])] : [];
+	return {
+		join: ` INNER JOIN ${fromTable(source.through, dialect)} ON ${dialect.column(keys, id)} = ${dialect.column(table, ref)}`,
+		where: [`${dialect.column(keys, source.column)} = ${dialect.literal(role)}`, ...guarded].join(" AND ")
+	};
+}
+/** The kinds filter of role `role`: `[]` for none, `undefined` when no row of the source has one of its kinds. */
+function kindFilter(stream, role, table, ctx) {
+	const kinds = ctx.kinds[role];
+	if (kinds === void 0) return [];
+	const { via } = stream;
+	if (via === void 0) return;
+	if ("value" in via) return kinds.includes(via.value) ? [] : void 0;
+	return kinds.length === 0 ? void 0 : [anyOf(kinds.map((kind) => `${ctx.dialect.column(table, via.column)} = ${ctx.dialect.literal(kind)}`))];
+}
+/**
+* One `IN (SELECT …)` per role source of the stream that can hold one of
+* `roles` in scope `scope`: the row's `left` is an instance the user holds it
+* in. A null role never equals a key, so a row without a role grants nothing.
+*/
+function sourceIn(stream, scope, left, roles, ctx) {
+	const own = ownRows(stream, ctx.dialect, scope);
+	const select = (join, filters) => `${left} IN (SELECT ${ctx.dialect.column(own.table, stream.id)} FROM ${own.from}${join} WHERE ${[...own.where, ...filters].join(" AND ")})`;
+	const out = [];
+	for (const role of roles) {
+		const kinds = kindFilter(stream, role, own.table, ctx);
+		if (kinds === void 0) continue;
+		if (isFixed(stream.roles)) {
+			if (stream.roles.value.includes(role)) out.push([select("", kinds)]);
+			continue;
+		}
+		for (const source of roleSources(stream.roles)) {
+			const filter = roleFilter(stream, source, role, own.table, ctx.dialect);
+			if (filter !== void 0) out.push([select(filter.join, [...kinds, filter.where])]);
+		}
+	}
+	return out;
+}
+/** The roles tables the source joins through, each with the query of the rows the user's own rows reference. */
+function roleTableRows(stream, dialect) {
+	if (isFixed(stream.roles)) return [];
+	const own = ownRows(stream, dialect);
+	return roleSources(stream.roles).flatMap((source) => {
+		if (typeof source === "string" || "map" in source) return [];
+		const keys = bare(source.through, dialect);
+		const [ref, id] = pairOf(source);
+		return [{
+			table: keys,
+			query: `SELECT * FROM ${fromTable(source.through, dialect)} WHERE ${dialect.column(keys, id)} IN (SELECT ${dialect.column(own.table, ref)} FROM ${own.from} WHERE ${own.where.join(" AND ")})`
+		}];
+	});
+}
+//#endregion
+//#region src/cli/powersync/rows.ts
+function throughColumn(through, device) {
+	const [pair] = Object.entries(through.on);
+	return {
+		column: pair?.[0] ?? "",
+		through: {
+			table: device(through.through),
+			id: pair?.[1] ?? "",
+			column: through.column
+		}
+	};
+}
+function roleColumn(source, device) {
+	if (typeof source === "string") return { column: source };
+	return "map" in source ? {
+		column: source.column,
+		map: source.map
+	} : throughColumn(source, device);
+}
+function roleColumns(roles, device) {
+	return roleSources(roles).map((source) => roleColumn(source, device));
+}
+function sourceRows(stream, device) {
+	return compact({
+		table: device(stream.table),
+		user: typeof stream.user === "string" ? { column: stream.user } : throughColumn(stream.user, device),
+		scope: stream.scope,
+		id: stream.id,
+		roles: isFixed(stream.roles) ? { value: [...stream.roles.value] } : roleColumns(stream.roles, device),
+		via: stream.via,
+		expiresAt: stream.expiresAt,
+		disabledAt: stream.disabledAt
+	});
+}
+function tableRows(table, scope, id, device) {
+	return compact({
+		table: device(table.table),
+		user: { column: table.user },
+		scope: { value: scope },
+		id,
+		roles: roleColumns(table.role, device),
+		via: table.via === void 0 ? void 0 : typeof table.via === "string" ? { column: table.via } : table.via,
+		expiresAt: table.expiresAt,
+		disabledAt: table.disabledAt
+	});
+}
+/**
+* The manifest's `rows`: the tables the subject streams sync, as a device
+* reads them. A scope's `rls.memberships` table, else its membership
+* sources; the global roles table; and the custom-role tables in `database`
+* mode. `devices` holds the plan's renamed tables.
+*/
+function localRows(policy, config, devices) {
+	const names = { names: {
+		renamed: devices,
+		seen: /* @__PURE__ */ new Set()
+	} };
+	const device = (table) => bare(table, names);
+	const rls = config.rls;
+	const scopes = scopeList(policy.scopes);
+	const sources = membershipSourcesOf(config);
+	const memberships = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const scope of scopes) {
+		const table = scopeMembershipTable(rls?.memberships, scopes, scope.name);
+		if (table !== void 0) {
+			const id = scopeColumn(table, scopes, scope.name);
+			if (id !== void 0) memberships.push(tableRows(table, scope.name, id, device));
+			continue;
+		}
+		for (const source of scopeSourcesOf(sources, scope.name)) {
+			const { stream } = source.sql;
+			if (stream !== void 0 && !seen.has(stream)) {
+				seen.add(stream);
+				memberships.push(sourceRows(stream, device));
+			}
+		}
+	}
+	const schema = rls?.schema ?? "permdock";
+	const database = rls?.authorize === "database";
+	const global = rls?.roles ?? (database ? { table: `${schema}.user_roles` } : void 0);
+	return compact({
+		memberships,
+		roles: global === void 0 ? void 0 : {
+			table: device(global.table),
+			user: global.user ?? "user_id",
+			roles: [roleColumn(global.role ?? "role", device)]
+		},
+		customRoles: database && customRolesOn(rls) ? {
+			permissions: device(`${schema}.${CUSTOM_ROLES.permissions}`),
+			includes: device(`${schema}.${CUSTOM_ROLES.includes}`)
+		} : void 0
+	});
+}
+//#endregion
+//#region src/cli/powersync/levels.ts
+const ALIAS = "cr";
+/** The role key column of one role source, with the join to its roles table; `undefined` for a mapped column, which holds declared roles only. */
+function roleKeyOf(role, table, dialect) {
+	if (typeof role === "string") return {
+		join: "",
+		roleKey: dialect.column(table, role)
+	};
+	if ("map" in role) return;
+	const [pair] = Object.entries(role.on);
+	if (pair === void 0) return;
+	const keys = bare(role.through, dialect);
+	return {
+		join: ` INNER JOIN ${fromTable(role.through, dialect)} ON ${dialect.column(keys, pair[1])} = ${dialect.column(table, pair[0])}`,
+		roleKey: dialect.column(keys, role.column)
+	};
+}
+/**
+* The `IN (SELECT …)` of each root-scope source: the row's `left` is a tenant
+* where the user holds a custom role with an allow row of `key` at `level`
+* (`null` for an allow with no level). A role column the source maps or
+* fixes holds declared roles only, so it never names a custom role.
+*/
+function customRoleIn(ctx, root, left, key, level) {
+	const { dialect } = ctx;
+	const rls = ctx.config.rls;
+	const table = quotedTable(`${rls?.schema ?? "permdock"}.${CUSTOM_ROLES.permissions}`);
+	const cr = (column) => dialect.column(ALIAS, column);
+	const out = [];
+	for (const source of scopeSourcesOf(ctx.sources, root)) {
+		const stream = streamOf(source);
+		if (typeof stream === "string") {
+			ctx.gaps.push(stream);
+			continue;
+		}
+		if (isFixed(stream.roles)) continue;
+		const own = ownRows(stream, dialect, root);
+		const id = dialect.column(own.table, stream.id);
+		for (const role of roleSources(stream.roles)) {
+			const keyed = roleKeyOf(role, own.table, dialect);
+			if (keyed === void 0) continue;
+			const { join, roleKey } = keyed;
+			const filters = [
+				...own.where,
+				`${cr("tenant_id")} = ${id}`,
+				`${cr("scope")} = ${dialect.literal(root)}`,
+				`${cr("permission")} = ${dialect.literal(key)}`,
+				`${cr("effect")} = ${dialect.literal("allow")}`,
+				level === null ? `${cr("level")} IS NULL` : `${cr("level")} = ${dialect.literal(level)}`
+			];
+			out.push([`${left} IN (SELECT ${id} FROM ${own.from}${join} INNER JOIN ${table} AS ${ALIAS} ON ${cr("role")} = ${roleKey} WHERE ${filters.join(" AND ")})`]);
+		}
+	}
+	return out;
+}
+/**
+* What a custom role can reach on `resource` through `key`, in `database`
+* mode when the root scope reads membership sources: each allow of `key` by
+* an assignable role at the root scope (the ceiling), once for an allow with
+* no level and once per level the resource declares, narrowed by that
+* level's condition. `skipped` says why a root scope with custom roles
+* reaching `key` has no custom-role stream.
+*/
+function customRoleItems(ctx, grants, resource, key, table) {
+	const rls = ctx.config.rls;
+	const root = ctx.scopes[0]?.name;
+	const field = ctx.policy.scopes.find((scope) => scope.name === root)?.key;
+	if (rls?.authorize !== "database" || !customRolesOn(rls) || root === void 0 || field === void 0 || !SQL_IDENT.test(field)) return { items: [] };
+	const assignable = new Set(assignableRoles(ctx.policy));
+	const ceiling = grants.filter((item) => item.access.kind === "role" && item.access.scope === root && assignable.has(item.access.role) && item.grant.effect === "allow" && item.grant.permission.key === key);
+	if (ceiling.length === 0) return { items: [] };
+	if (scopeMembershipTable(rls.memberships, ctx.scopes, root) !== void 0) return {
+		items: [],
+		skipped: `the ${root} scope reads an rls.memberships table; custom-role streams read rls.membershipSources`
+	};
+	const left = ctx.dialect.column(table, field);
+	return { items: [[null, void 0], ...policyLevels(ctx.policy, resource)].flatMap(([level, condition]) => {
+		const access = customRoleIn(ctx, root, left, key, level);
+		const label = `${CUSTOM_ROLE}/${key}${level === null ? "" : `@${level}`}`;
+		return access.length === 0 ? [] : ceiling.map((item) => {
+			const where = andConditions(item.where, condition);
+			return {
+				label,
+				level,
+				access,
+				item: where === void 0 ? item : {
+					...item,
+					where
+				}
+			};
+		});
+	}) };
+}
+//#endregion
+//#region src/cli/powersync/streams.ts
+const POWERSYNC = {
+	user: "auth.user_id()",
+	claim: (name) => `auth.parameter(${quoteSqlLiteral(name)})`,
+	claims: (name) => `(SELECT value FROM json_each(auth.parameter(${quoteSqlLiteral(name)})))`,
+	column: (table, name) => `${table}.${ident(name)}`,
+	literal: (value) => typeof value === "string" ? quoteSqlLiteral(value) : String(value)
+};
+const POSTGRES = {
+	user: "$1::text",
+	claim: (name) => `($2::jsonb ->> ${quoteSqlLiteral(name)})`,
+	claims: (name) => `(select jsonb_array_elements_text(case jsonb_typeof($2::jsonb -> ${quoteSqlLiteral(name)}) when 'array' then $2::jsonb -> ${quoteSqlLiteral(name)} else '[]'::jsonb end))`,
+	column: (table, name, numeric) => `${table}.${ident(name)}${numeric === true ? "" : "::text"}`,
+	literal: (value) => typeof value === "number" ? String(value) : quoteSqlLiteral(String(value))
+};
+/** At most this many queries per stream; a wider `or` product is left out rather than truncated. */
+const MAX_QUERIES = 32;
+/** Every combination of one clause list from each input, ANDed. */
+function product(lists) {
+	let out = [[]];
+	for (const list of lists) out = out.flatMap((left) => list.map((right) => left.concat(right)));
+	return out;
+}
+function every(parts) {
+	const out = [];
+	for (const part of parts) {
+		if (part === void 0) return;
+		out.push(part);
+	}
+	return out;
+}
+/** A row value: a literal, or a principal ref the token carries. `undefined` when neither. */
+function valueSql(value, ctx) {
+	if (isConditionRef(value)) {
+		if (value.ref === "principal.id") return ctx.dialect.user;
+		const claim = /^principal\.claims\.([A-Za-z_][A-Za-z0-9_]*)$/u.exec(value.ref)?.[1];
+		return claim === void 0 ? void 0 : ctx.dialect.claim(claim);
+	}
+	if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") return ctx.dialect.literal(value);
+}
+const COMPARE = {
+	eq: "=",
+	ne: "!=",
+	gt: ">",
+	gte: ">=",
+	lt: "<",
+	lte: "<="
+};
+/**
+* A row condition as alternatives of ANDed clauses over `table`. `undefined`
+* when part of it has no Sync Streams form, so the grant syncs nothing.
+*/
+function conditionSql(condition, table, ctx) {
+	const column = (field) => SQL_IDENT.test(field) ? ctx.dialect.column(table, field) : void 0;
+	switch (condition.op) {
+		case "eq":
+		case "ne":
+		case "gt":
+		case "gte":
+		case "lt":
+		case "lte": {
+			const left = typeof condition.value === "number" && SQL_IDENT.test(condition.field) ? ctx.dialect.column(table, condition.field, true) : column(condition.field);
+			if (condition.value === null && left !== void 0) return condition.op === "eq" ? [[`${left} IS NULL`]] : condition.op === "ne" ? [[`${left} IS NOT NULL`]] : void 0;
+			const right = valueSql(condition.value, ctx);
+			return left === void 0 || right === void 0 ? void 0 : [[`${left} ${COMPARE[condition.op]} ${right}`]];
+		}
+		case "isNull": {
+			const left = column(condition.field);
+			return left === void 0 ? void 0 : [[`${left} IS ${condition.value ? "" : "NOT "}NULL`]];
+		}
+		case "in":
+		case "notIn": {
+			const left = column(condition.field);
+			if (left === void 0) return;
+			const negate = condition.op === "notIn" ? "NOT " : "";
+			if (isConditionRef(condition.value)) {
+				const claim = /^principal\.claims\.([A-Za-z_][A-Za-z0-9_]*)$/u.exec(condition.value.ref)?.[1];
+				return claim === void 0 || negate !== "" ? void 0 : [[`${left} IN ${ctx.dialect.claims(claim)}`]];
+			}
+			const values = condition.value.map((value) => isConditionRef(value) || isConditionDate(value) || Array.isArray(value) ? void 0 : value === null ? void 0 : valueSql(value, ctx));
+			if (values.some((value) => value === void 0)) return;
+			return values.length === 0 ? negate === "" ? [] : [[]] : [[`${left} ${negate}IN (${values.join(", ")})`]];
+		}
+		case "and":
+		case "or": {
+			const parts = every(condition.conditions.map((child) => conditionSql(child, table, ctx)));
+			if (parts === void 0) return;
+			return condition.op === "and" ? product(parts) : parts.flat();
+		}
+		case "memberOf": {
+			if (condition.scope === "resource" || condition.parents !== void 0) return;
+			const scope = resolveScope(ctx.scopes, condition.scope);
+			const left = column(condition.field);
+			if (scope === void 0 || left === void 0) return;
+			return membershipSql(scope, left, condition.roles, ctx);
+		}
+		case "sqlFunction": return conditionSql(condition.twin, table, ctx);
+		case "not":
+		case "contains":
+		case "related":
+		case "opaque":
+		case "liveSession": return;
+		default: return condition;
+	}
+}
+/** One `IN (SELECT …)` per role source of the membership table: the row's `left` is an instance the user holds `roles` in. */
+function membershipIn(table, idColumn, left, roles, ctx) {
+	if (table.expiresAt !== void 0 || table.disabledAt !== void 0) return;
+	const name = bare(table.table, ctx.dialect);
+	const sources = Array.isArray(table.role) ? table.role : [table.role];
+	const kinds = [...new Set(roles.flatMap((role) => ctx.kinds[role] ?? []))];
+	const restricted = roles.some((role) => ctx.kinds[role] !== void 0);
+	if (restricted && (table.via === void 0 || roles.length !== 1)) return;
+	const via = table.via;
+	if (restricted && typeof via === "object" && !kinds.includes(via.value)) return [];
+	const filters = [`${ctx.dialect.column(name, table.user)} = ${ctx.dialect.user}`, ...restricted && typeof via === "string" ? [`${ctx.dialect.column(name, via)} IN (${kinds.map((kind) => ctx.dialect.literal(kind)).join(", ")})`] : []];
+	const list = roles.map((role) => ctx.dialect.literal(role)).join(", ");
+	return sources.map((source) => {
+		if (typeof source === "string") return [`${left} IN (SELECT ${ctx.dialect.column(name, idColumn)} FROM ${fromTable(table.table, ctx.dialect)} WHERE ${[...filters, `${ctx.dialect.column(name, source)} IN (${list})`].join(" AND ")})`];
+		if ("map" in source) {
+			const values = Object.entries(source.map).filter(([, key]) => key !== null && roles.includes(key)).map(([value]) => ctx.dialect.literal(value));
+			if (values.length === 0) return ["1 = 0"];
+			return [`${left} IN (SELECT ${ctx.dialect.column(name, idColumn)} FROM ${fromTable(table.table, ctx.dialect)} WHERE ${[...filters, `${ctx.dialect.column(name, source.column)} IN (${values.join(", ")})`].join(" AND ")})`];
+		}
+		const [pair] = Object.entries(source.on);
+		const keys = bare(source.through, ctx.dialect);
+		const [ref, id] = pair ?? ["", ""];
+		return [`${left} IN (SELECT ${ctx.dialect.column(name, idColumn)} FROM ${fromTable(table.table, ctx.dialect)} INNER JOIN ${fromTable(source.through, ctx.dialect)} ON ${ctx.dialect.column(keys, id)} = ${ctx.dialect.column(name, ref)} WHERE ${[...filters, `${ctx.dialect.column(keys, source.column)} IN (${list})`].join(" AND ")})`];
+	});
+}
+/** The membership filter of scope `scope`: its `rls.memberships` table, else the union of its membership sources. */
+function membershipSql(scope, left, roles, ctx) {
+	const table = scopeMembershipTable(ctx.config.rls?.memberships, ctx.scopes, scope);
+	if (table !== void 0) {
+		const idColumn = scopeColumn(table, ctx.scopes, scope);
+		return idColumn === void 0 ? void 0 : membershipIn(table, idColumn, left, roles, ctx);
+	}
+	const sources = scopeSourcesOf(ctx.sources, scope);
+	if (sources.length === 0) return;
+	return sources.flatMap((source) => {
+		const stream = streamOf(source);
+		if (typeof stream === "string") {
+			ctx.gaps.push(stream);
+			return [];
+		}
+		return sourceIn(stream, scope, left, roles, ctx);
+	});
+}
+/** Who the grant reaches, as alternatives of clauses; `undefined` when Sync Streams cannot express it. */
+function accessSql(item, table, ctx) {
+	const { access } = item;
+	switch (access.kind) {
+		case "anyone":
+		case "authenticated": return [[]];
+		case "role": {
+			if (access.scope === "global") return `global role ${access.role} is not a row filter`;
+			const field = ctx.policy.scopes.find((scope) => scope.name === access.scope)?.key;
+			if (field === void 0 || !SQL_IDENT.test(field)) return `scope ${access.scope} has no row key`;
+			return membershipSql(access.scope, ctx.dialect.column(table, field), [access.role], ctx) ?? `no rls.memberships table without an expiry or disabledAt and with the kinds of ${access.role}, and no membership source, for scope ${access.scope}`;
+		}
+		case "resource": {
+			const holder = ctx.config.rls?.memberships?.resource?.[access.resource];
+			const node = ctx.policy.resources.get(item.grant.permission.resource);
+			const field = node?.name === access.resource ? node.id : node?.parent?.resource === access.resource ? node.parent.field : void 0;
+			if (holder === void 0 || field === void 0 || !SQL_IDENT.test(field)) return `no rls.memberships.resource table for ${access.resource} on the row`;
+			return membershipIn(holder, holder.id ?? "id", ctx.dialect.column(table, field), [access.role], ctx) ?? `the ${access.resource} memberships table has an expiry or disabledAt, or lacks via`;
+		}
+		case "actor": return "actor grantees are not in the sync token";
+		default: return access;
+	}
+}
+/** A table outside `public` as `quotedTable` writes it. */
+const QUOTED_TABLE = /"(\w+)"\."(\w+)"/gu;
+/** `permdock_<table>`; a table in the `permdock` schema, `permdock_<table>` already, keeps one prefix. */
+function subjectStreamName(table) {
+	return table.startsWith("permdock_") ? table : `permdock_${table}`;
+}
+function roleThroughs(role) {
+	return (Array.isArray(role) ? role : [role]).filter((item) => typeof item === "object" && item !== null && "through" in item);
+}
+/**
+* The `SELECT`s of the root-scope ids the user is a member of: the root
+* scope's `rls.memberships` table, else each of its sources that can filter a
+* stream.
+*/
+function userTenantIds(ctx) {
+	const { dialect } = ctx;
+	const root = ctx.scopes[0]?.name;
+	if (root === void 0) return [];
+	const tenants = scopeMembershipTable(ctx.config.rls?.memberships, ctx.scopes, root);
+	if (tenants !== void 0) {
+		const column = scopeColumn(tenants, ctx.scopes, root);
+		const members = bare(tenants.table, dialect);
+		return column === void 0 ? [] : [`SELECT ${dialect.column(members, column)} FROM ${fromTable(tenants.table, dialect)} WHERE ${dialect.column(members, tenants.user)} = ${dialect.user}`];
+	}
+	return scopeSourcesOf(ctx.sources, root).flatMap((source) => {
+		const stream = streamOf(source);
+		if (typeof stream === "string") return [];
+		const rows = ownRows(stream, dialect, root);
+		return [`SELECT ${dialect.column(rows.table, stream.id)} FROM ${rows.from} WHERE ${rows.where.join(" AND ")}`];
+	});
+}
+/** The stream forms of the sources of every scope `rls.memberships` maps no table for. */
+function unmappedStreams(ctx) {
+	const out = /* @__PURE__ */ new Set();
+	for (const scope of ctx.scopes) {
+		if (scopeMembershipTable(ctx.config.rls?.memberships, ctx.scopes, scope.name) !== void 0) continue;
+		for (const source of scopeSourcesOf(ctx.sources, scope.name)) if (source.sql.stream !== void 0) out.add(source.sql.stream);
+	}
+	return [...out];
+}
+/**
+* Streams of the rows a device builds the user's snapshot from: the user's
+* own membership and global-role rows, the roles tables they reference, and
+* the custom roles of the user's tenants. Each query starts from the user's
+* own rows.
+*/
+function subjectStreams(ctx) {
+	const rls = ctx.config.rls;
+	const { dialect } = ctx;
+	const tables = /* @__PURE__ */ new Map();
+	const add = (table, query, user) => {
+		const entry = tables.get(table) ?? {
+			user: void 0,
+			queries: /* @__PURE__ */ new Set()
+		};
+		if (entry.queries.size === 0) entry.user = user;
+		else if (entry.user !== user) entry.user = void 0;
+		entry.queries.add(query);
+		tables.set(table, entry);
+	};
+	const own = (table, user, role) => {
+		const name = bare(table, dialect);
+		const mine = `${dialect.column(name, user)} = ${dialect.user}`;
+		add(name, `SELECT * FROM ${fromTable(table, dialect)} WHERE ${mine}`, user);
+		for (const through of roleThroughs(role)) {
+			const keys = bare(through.through, dialect);
+			const [pair] = Object.entries(through.on);
+			if (pair === void 0) continue;
+			const [ref, id] = pair;
+			add(keys, `SELECT * FROM ${fromTable(through.through, dialect)} WHERE ${dialect.column(keys, id)} IN (SELECT ${dialect.column(name, ref)} FROM ${fromTable(table, dialect)} WHERE ${mine})`);
+		}
+	};
+	const memberships = rls?.memberships;
+	for (const table of [
+		...Object.values(memberships?.scopes ?? {}),
+		...memberships?.tenant === void 0 ? [] : [memberships.tenant],
+		...memberships?.team === void 0 ? [] : [memberships.team],
+		...Object.values(memberships?.resource ?? {})
+	]) own(table.table, table.user, table.role);
+	for (const stream of unmappedStreams(ctx)) {
+		const rows = ownRows(stream, dialect);
+		add(rows.table, typeof stream.user === "string" ? `SELECT * FROM ${rows.from} WHERE ${rows.where.join(" AND ")}` : `SELECT ${rows.table}.* FROM ${rows.from} WHERE ${rows.where.join(" AND ")}`, typeof stream.user === "string" ? stream.user : void 0);
+		if (typeof stream.user !== "string") {
+			const users = bare(stream.user.through, dialect);
+			add(users, `SELECT * FROM ${fromTable(stream.user.through, dialect)} WHERE ${dialect.column(users, stream.user.column)} = ${dialect.user}`, stream.user.column);
+		}
+		for (const keys of roleTableRows(stream, dialect)) add(keys.table, keys.query);
+	}
+	const schema = rls?.schema ?? "permdock";
+	const database = rls?.authorize === "database";
+	const globalRoles = rls?.roles ?? (database ? { table: `${schema}.user_roles` } : void 0);
+	if (globalRoles !== void 0) own(globalRoles.table, globalRoles.user ?? "user_id", globalRoles.role ?? "role");
+	if (database && customRolesOn(rls)) {
+		const tenantIds = userTenantIds(ctx);
+		for (const name of [CUSTOM_ROLES.permissions, CUSTOM_ROLES.includes]) {
+			const qualified = `${schema}.${name}`;
+			const table = bare(qualified, dialect);
+			const from = fromTable(qualified, dialect);
+			const tenant = dialect.column(table, "tenant_id");
+			add(table, `SELECT * FROM ${from} WHERE ${tenant} IS NULL`);
+			for (const ids of tenantIds) add(table, `SELECT * FROM ${from} WHERE ${tenant} IN (${ids})`);
+		}
+	}
+	const out = [];
+	const names = /* @__PURE__ */ new Set();
+	for (const [table, entry] of tables) {
+		const short = subjectStreamName(table);
+		const name = names.has(short) ? `permdock_${table}` : short;
+		names.add(name);
+		const queries = [...entry.queries];
+		out.push(entry.user === void 0 ? {
+			name,
+			table,
+			queries
+		} : {
+			name,
+			table,
+			user: entry.user,
+			queries
+		});
+	}
+	return out;
+}
+/** The membership sources as `rls generate` reads them: a tenant row of the custom roles table named like a declared role is no role. */
+function guardedSources(policy, config) {
+	const roles = config.rls?.customRoleWrites?.roles;
+	const guard = roles?.tenant === void 0 ? void 0 : {
+		table: roles.table,
+		tenant: roles.tenant,
+		skip: roles.skip,
+		declared: [...roleNames(policy)].toSorted()
+	};
+	return membershipSourcesOf(config).map((source) => guard === void 0 ? source : source.guarded?.(guard) ?? source);
+}
+/** Why a grant cannot become a stream query, before its conditions are compiled. */
+function unsupported(item) {
+	const { grant } = item;
+	if (grant.breakGlass !== void 0) return "break-glass";
+	if (grant.closure !== void 0 || grant.portable === false) return "not portable";
+	if (requiresApproval(grant.approval)) return "needs approval";
+	if (grant.validity !== void 0) return "time-bounded";
+	const context = contextRefs(item.where);
+	return context.length > 0 ? `reads ${context.join(", ")}` : void 0;
+}
+/**
+* Sync Streams for each synced resource: the union of the rows its read
+* permission's allow grants reach. A grant with any part Sync Streams cannot
+* express syncs nothing, and a resource with a deny grant gets no stream, so
+* a stream never holds a row the policy denies.
+*/
+function powersyncPlan(policy, config, dialect = POWERSYNC) {
+	const seen = /* @__PURE__ */ new Set();
+	const first = planWith(policy, config, {
+		...dialect,
+		names: {
+			renamed: /* @__PURE__ */ new Map(),
+			seen
+		}
+	});
+	const renamed = renames(seen);
+	return renamed.size === 0 ? first : planWith(policy, config, {
+		...dialect,
+		names: {
+			renamed,
+			seen: /* @__PURE__ */ new Set()
+		}
+	});
+}
+function planWith(policy, config, dialect) {
+	const scopes = scopeList(policy.scopes);
+	const ctx = {
+		policy,
+		config,
+		scopes,
+		kinds: ownershipRules(policy, scopes)?.kinds ?? {},
+		dialect,
+		sources: guardedSources(policy, config),
+		gaps: []
+	};
+	const action = config.powersync?.action ?? "read";
+	const grants = collectGrants(policy);
+	const resources = config.powersync?.resources ?? [...policy.resources.keys()].filter((name) => grants.some((item) => item.grant.permission.resource === name && item.grant.permission.action === action));
+	const streams = [];
+	const omitted = [];
+	const warnings = [];
+	const unsynced = [];
+	for (const resource of resources) {
+		const node = policy.resources.get(resource);
+		const key = `${resource}.${action}`;
+		const items = grants.filter((item) => item.grant.permission.key === key);
+		if (node === void 0 || items.length === 0) {
+			omitted.push({
+				resource,
+				reason: `no grant of ${key}`
+			});
+			continue;
+		}
+		if (items.some((item) => item.grant.effect === "deny")) {
+			omitted.push({
+				resource,
+				reason: `${key} has a deny grant, which Sync Streams cannot subtract`
+			});
+			continue;
+		}
+		const source = tableFor(resource, tableNames(config.rls?.tables));
+		const table = bare(source, ctx.dialect);
+		const { id } = node;
+		const queries = /* @__PURE__ */ new Set();
+		const compile = (label, gap, item, reach) => {
+			const access = unsupported(item) ?? reach();
+			const where = typeof access === "string" || item.where === void 0 ? [[]] : conditionSql(item.where, table, ctx);
+			const gaps = [...new Set(ctx.gaps.splice(0))];
+			for (const reason of gaps) warnings.push(`${label} under-syncs: ${reason}`);
+			if (typeof access === "string") warnings.push(`${label} does not sync: ${access}`);
+			else if (where === void 0) warnings.push(`${label} does not sync: its condition has no Sync Streams form`);
+			if (gaps.length > 0 || typeof access === "string" || where === void 0) unsynced.push(gap);
+			if (typeof access === "string" || where === void 0) return;
+			const columns = item.grant.fields === void 0 ? "*" : [.../* @__PURE__ */ new Set([id, ...item.grant.fields])].map((field) => ctx.dialect.column(table, field)).join(", ");
+			for (const clauses of product([access, where])) queries.add(`SELECT ${columns} FROM ${fromTable(source, ctx.dialect)}${clauses.length === 0 ? "" : ` WHERE ${clauses.join(" AND ")}`}`);
+		};
+		for (const item of items) compile(`${item.label}/${key}`, {
+			permission: key,
+			role: item.label
+		}, item, () => accessSql(item, table, ctx));
+		const { items: custom, skipped } = customRoleItems(ctx, grants, resource, key, table);
+		if (skipped !== void 0) ctx.gaps.push(skipped);
+		for (const entry of custom) compile(entry.label, {
+			permission: key,
+			role: CUSTOM_ROLE,
+			level: entry.level
+		}, entry.item, () => entry.access);
+		const dropped = [...new Set(ctx.gaps.splice(0))];
+		for (const reason of dropped) warnings.push(`${CUSTOM_ROLE}/${key} does not sync: ${reason}`);
+		if (dropped.length > 0) unsynced.push({
+			permission: key,
+			role: CUSTOM_ROLE
+		});
+		if (custom.length > 0) {
+			warnings.push(`${CUSTOM_ROLE}/${key}: a custom role's deny rows, includes and shared roles do not change its stream; the device still applies them`);
+			unsynced.push({
+				permission: key,
+				role: CUSTOM_ROLE,
+				composed: true
+			});
+		}
+		if (queries.size === 0) omitted.push({
+			resource,
+			reason: `no grant of ${key} compiles`
+		});
+		else if (queries.size > MAX_QUERIES) omitted.push({
+			resource,
+			reason: `${String(queries.size)} queries, over the limit of ${String(MAX_QUERIES)}`
+		});
+		else streams.push({
+			name: resource,
+			resource,
+			table,
+			id,
+			queries: [...queries]
+		});
+	}
+	const subject = subjectStreams(ctx);
+	const outside = [...new Set([...streams, ...subject].flatMap((stream) => stream.queries.flatMap((query) => [...query.matchAll(QUOTED_TABLE)].map(([, schema, name]) => `${schema ?? ""}.${name ?? ""}`))))].toSorted();
+	return {
+		streams,
+		subject,
+		omitted,
+		warnings,
+		unsynced,
+		devices: dialect.names?.renamed ?? /* @__PURE__ */ new Map(),
+		outside,
+		...outside.length === 0 ? {} : { publication: `alter publication powersync add table ${outside.join(", ")};` }
+	};
+}
+/** A YAML scalar quoted as oxfmt and Prettier write it: single quotes around a `"`, unless a backslash needs a double-quoted escape. */
+function yamlString(text) {
+	return text.includes("\"") && !text.includes("\\") ? `'${text.replaceAll("'", "''")}'` : JSON.stringify(text);
+}
+/** `sync-config.yaml`: edition 3 Sync Streams, one auto-subscribed stream per synced resource. */
+function powersyncYaml(plan) {
+	const lines = [
+		"# Generated by permdock powersync generate from the policy. Do not edit.",
+		...plan.publication === void 0 ? [] : ["# Tables outside public must be in the powersync publication:", `# ${plan.publication}`],
+		"config:",
+		"  edition: 3",
+		"",
+		"streams:"
+	];
+	if (plan.streams.length === 0 && plan.subject.length === 0) lines[lines.length - 1] = "streams: {}";
+	for (const stream of [...plan.streams, ...plan.subject]) lines.push(`  ${stream.name}:`, "    auto_subscribe: true", "    queries:", ...stream.queries.map((query) => `      - ${yamlString(query)}`));
+	for (const item of plan.omitted) lines.push(`# ${item.resource}: not synced, ${item.reason}`);
+	return `${lines.join("\n")}\n`;
+}
+//#endregion
+//#region src/cli/powersync/verify-gaps.ts
+function heldRoles(subject) {
+	return /* @__PURE__ */ new Set([...subject.roles ?? [], ...(subject.memberships ?? []).flatMap((membership) => membership.roles)]);
+}
+function customGap(gap, roles) {
+	if (gap.composed === true) return roles.some((role) => (role.includes ?? []).length > 0 || role.shared === true || role.scope === "global");
+	return roles.some((role) => (role.grants ?? []).some((grant) => grant.permission === gap.permission && (grant.effect ?? "allow") === "allow" && (gap.level === void 0 || (grant.level ?? null) === gap.level)));
+}
+/**
+* Whether `generate` warned for a grant the fixture's subject holds of
+* `permission`: a declared role it holds, `anyone` or `authenticated`, or a
+* custom role it holds at the warned level.
+*/
+function warnedFor(unsynced, permission, subject, customRoles) {
+	const held = heldRoles(subject);
+	const custom = customRoles.filter((role) => held.has(role.name));
+	return unsynced.some((gap) => {
+		if (gap.permission !== permission) return false;
+		if (gap.role === "custom role") return customGap(gap, custom);
+		return gap.role === "anyone" || gap.role === "authenticated" || held.has(gap.role);
+	});
+}
+//#endregion
+//#region src/cli/powersync/powersync.ts
+const POWERSYNC_HELP = `permdock powersync generate [--out sync-config.yaml] [--check]
+permdock powersync verify [--db-url-stdin] [--fixtures rls.fixtures.json]`;
+const DEFAULT_OUT = "sync-config.yaml";
+function powersyncOut(config, out) {
+	return out ?? config.powersync?.out ?? DEFAULT_OUT;
+}
+function loadPolicy(cwd, config, from) {
+	return requirePolicy(cwd, from ?? config.policy, "powersync needs policy in the config or --policy");
+}
+function sameJson(current, expected) {
+	try {
+		return JSON.stringify(JSON.parse(current)) === JSON.stringify(JSON.parse(expected));
+	} catch {
+		return false;
+	}
+}
+/**
+* The files the policy compiles to: the Sync Streams file and, with
+* `powersync.manifest`, the local-snapshot manifest. `warnings` lists the
+* grants that do not sync.
+*/
+function powersyncFiles(policy, config, out) {
+	const plan = powersyncPlan(policy, config);
+	const files = [{
+		path: powersyncOut(config, out),
+		text: powersyncYaml(plan)
+	}];
+	const manifest = config.powersync?.manifest;
+	if (manifest !== void 0) files.push({
+		path: manifest,
+		json: true,
+		text: `${JSON.stringify({
+			...localSnapshotManifest(policy),
+			rows: localRows(policy, config, plan.devices)
+		}, null, 2)}\n`
+	});
+	return {
+		files,
+		warnings: plan.warnings,
+		...plan.publication === void 0 ? {} : { publication: plan.publication }
+	};
+}
+/** The files whose content on disk is not what the policy compiles to, with `missing` for an absent one. */
+function staleFiles(cwd, files) {
+	const stale = [];
+	for (const file of files) {
+		const found = fileDrift(resolve(cwd, file.path), file.text, file.json === true ? sameJson : void 0);
+		if (found !== void 0) stale.push({
+			path: file.path,
+			missing: found.kind === "missing"
+		});
+	}
+	return stale;
+}
+function rowValue(row, key) {
+	const value = key !== void 0 && row !== null && typeof row === "object" && !Array.isArray(row) ? Object.entries(row).find(([name]) => name === key)?.[1] : void 0;
+	return value === void 0 || value === null ? void 0 : String(value);
+}
+function claimsJson(fixture) {
+	return JSON.stringify(fixture.subject.claims ?? {});
+}
+/** Whether a stream of the user's own rows holds a row of another user. */
+async function leaks(query, stream, user, fixture) {
+	for (const text of stream.queries) if ((await query(`select 1 from (${text}) q where q.${quoteIdent(user)}::text is distinct from $1::text and $2::jsonb is not null limit 1`, [fixture.subject.id, claimsJson(fixture)])).length > 0) return true;
+	return false;
+}
+/** Whether the stream holds the fixture's row for its subject; `undefined` for a row with no id. */
+async function synced(query, stream, fixture) {
+	const value = rowValue(fixture.row, stream.id);
+	if (value === void 0) return;
+	for (const text of stream.queries) if ((await query(`select 1 from (${text}) q where q.${quoteIdent(stream.id)}::text = $3::text and $1::text is not null and $2::jsonb is not null limit 1`, [
+		fixture.subject.id,
+		claimsJson(fixture),
+		value
+	])).length > 0) return true;
+	return false;
+}
+async function verifyStreams(input) {
+	const plan = powersyncPlan(input.policy, input.config, POSTGRES);
+	const mismatches = [];
+	const notes = [];
+	const client = await input.connect(input.db);
+	const query = async (sql, values) => (await client.query(sql, values)).rows;
+	const root = input.policy.scopes.find((scope) => scope.within === void 0)?.key;
+	try {
+		const checked = /* @__PURE__ */ new Set();
+		for (const fixture of input.fixtures) {
+			if (checked.has(fixture.subject.id)) continue;
+			checked.add(fixture.subject.id);
+			for (const stream of plan.subject) if (stream.user !== void 0 && await leaks(query, stream, stream.user, fixture)) mismatches.push(`stream ${stream.name} syncs another user's ${stream.table} rows to ${fixture.subject.id}`);
+		}
+		for (const fixture of input.fixtures) {
+			const permission = findPermission(input.policy.permissions, fixture.action);
+			const stream = plan.streams.find((item) => permission !== void 0 && item.resource === permission.resource && permission.action === (input.config.powersync?.action ?? "read"));
+			if (permission === void 0 || stream === void 0) continue;
+			const tenant = rowValue(fixture.row, root);
+			const permdock = await getPermDock(input.policy, fixtureSubject({
+				...fixture.subject,
+				...tenant === void 0 ? {} : { tenant }
+			}), { customRoles: memoryCustomRoleSource(input.customRoles) });
+			const granted = canFixture(permdock, permission, fixtureRow(fixture, permission.kind));
+			const holds = await synced(query, stream, fixture);
+			if (holds === void 0) notes.push(`${fixture.action} for ${fixture.subject.id}: not checked against stream ${stream.name}: the fixture row has no ${stream.id}`);
+			else if (holds && !granted) mismatches.push(`${fixture.action} for ${fixture.subject.id}: stream ${stream.name} syncs a row the policy denies`);
+			else if (granted && !holds && warnedFor(plan.unsynced, permission.key, fixture.subject, input.customRoles)) notes.push(`${fixture.action} for ${fixture.subject.id}: granted, not synced (the app reads it from the server)`);
+			else if (granted && !holds) mismatches.push(`${fixture.action} for ${fixture.subject.id}: granted, but stream ${stream.name} does not sync the row and generate gave no warning for it`);
+		}
+		await checkPublication(query, plan, mismatches, notes);
+	} finally {
+		await client.end();
+	}
+	return {
+		mismatches,
+		notes
+	};
+}
+/** PD058 when the `powersync` publication leaves out a synced table outside `public`; a note when the database has no such publication. */
+async function checkPublication(query, plan, mismatches, notes) {
+	if (plan.outside.length === 0) return;
+	if ((await query("select 1 from pg_catalog.pg_publication where pubname = 'powersync'", [])).length === 0) {
+		notes.push(`this database has no powersync publication; PowerSync needs the synced tables in it: ${plan.publication ?? ""}`);
+		return;
+	}
+	const published = new Set((await query("select schemaname || '.' || tablename as name from pg_catalog.pg_publication_tables where pubname = 'powersync'", [])).flatMap((row) => {
+		const name = rowValue(row, "name");
+		return name === void 0 ? [] : [name];
+	}));
+	for (const table of plan.outside) if (!published.has(table)) mismatches.push(`PD058: ${table} is not in the powersync publication, so PowerSync syncs none of its rows: ${plan.publication ?? ""}`);
+}
+async function runPowerSync(input) {
+	const [verb] = input.rest;
+	if (verb !== "generate" && verb !== "verify") return {
+		code: 2,
+		output: POWERSYNC_HELP
+	};
+	let policy;
+	let compiled;
+	try {
+		policy = await loadPolicy(input.cwd, input.config, input.from);
+		compiled = powersyncFiles(policy, input.config, input.out);
+	} catch (cause) {
+		return usageResult(cause);
+	}
+	const { files, warnings } = compiled;
+	const out = powersyncOut(input.config, input.out);
+	const stale = staleFiles(input.cwd, files);
+	if (verb === "generate") {
+		if (input.check) return stale.length === 0 ? {
+			code: 0,
+			output: files.map((file) => `${file.path} is current`).join("\n")
+		} : {
+			code: 1,
+			output: stale.map((file) => `${file.path} is stale: run permdock powersync generate`).join("\n")
+		};
+		applyFiles(input.cwd, files);
+		return {
+			code: 0,
+			output: [
+				...files.map((file) => `wrote ${file.path}`),
+				...compiled.publication === void 0 ? [] : [`add the tables outside public to the powersync publication: ${compiled.publication}`],
+				...warnings
+			].join("\n")
+		};
+	}
+	const mismatches = stale.map((file) => `${file.path} ${file.missing ? "is missing" : "differs from the policy"}: run permdock powersync generate`);
+	const notes = [...warnings];
+	if (input.db !== void 0) try {
+		const fixturesPath = input.fixtures ?? input.config.rls?.fixtures ?? "rls.fixtures.json";
+		const { fixtures, customRoles } = await loadFixtures(input.cwd, fixturesPath);
+		const database = await verifyStreams({
+			policy,
+			config: input.config,
+			fixtures,
+			customRoles,
+			db: input.db,
+			connect: input.connect ?? pgConnector("permdock powersync verify --db-url-stdin", input.cwd)
+		});
+		mismatches.push(...database.mismatches);
+		notes.push(...database.notes);
+	} catch (cause) {
+		return usageResult(cause);
+	}
+	if (mismatches.length > 0) return {
+		code: 1,
+		output: [...mismatches, ...notes].join("\n")
+	};
+	const verified = input.db === void 0 ? `${out} matches the policy` : `${out} matches the policy; no stream syncs a row the fixtures deny`;
+	return {
+		code: 0,
+		output: notes.length === 0 ? verified : `${verified}\n${notes.join("\n")}`
+	};
+}
+//#endregion
+export { streamOf as a, scopeSourcesOf as i, runPowerSync as n, staleFiles as r, powersyncFiles as t };