permdock 0.5.0 → 0.7.0

package/dist/{request-context-BTRTG7OT.js → request-context-BykKLmyE.js}

@@ -1,6 +1,6 @@
 import { t as assertAppData } from "./app-data-MuyzVqX8.js";
-import { n as wrapPermDock } from "./wrap-gX61EtpB.js";
-import { t as buildInstance } from "./build-instance-BMnAudHn.js";
+import { n as wrapPermDock } from "./wrap-CiSc_KCq.js";
+import { t as buildInstance } from "./build-instance-DxE7czo9.js";
 //#region src/core/request-context.ts
 /**
 * Errors an adapter raises around one instance (a `context` hook that threw,

package/dist/resend/index.d.ts

@@ -1,7 +1,7 @@
-import { q as DecisionSink } from "../policy-types-DzwivBgR.js";
-import { n as ApprovalUrl, t as ApprovalPrompt } from "../approval-prompt-Djo_PyZc.js";
-import { d as EmailTransport, o as DeliveryResult, u as EmailMessage } from "../types-DX0LaKTb.js";
-import { l as ReplayStore } from "../types-DiQjupG2.js";
+import { q as DecisionSink } from "../policy-types-B-F-qAZk.js";
+import { n as ApprovalUrl, t as ApprovalPrompt } from "../approval-prompt-K0faOLFp.js";
+import { d as EmailTransport, o as DeliveryResult, u as EmailMessage } from "../types-g7Oy6Zg4.js";
+import { l as ReplayStore } from "../types-cTos-H7p.js";
 //#region src/resend/approval-email.d.ts
 type ApprovalEmailOptions = {
   /** The app's approval page: a base the request id is appended to, or a function of the prompt. Must be https. */

package/dist/{retire-CALjIQ7e.js → retire-Wj6dkyDE.js}

@@ -1,6 +1,6 @@
-import { r as escapeSqlIdent } from "./sql-B5T1IL83.js";
+import { r as escapeSqlIdent } from "./sql-B96movIM.js";
 import { a as RETIRE_MARKER } from "./markers-C6joDI3o.js";
-import { r as tableKey } from "./deciding-columns-Sq12mEA6.js";
+import { r as tableKey } from "./deciding-columns-DRo2QM6E.js";
 //#region src/cli/rls/retire.ts
 const IDENT = String.raw`(?:"[^"]+"|[A-Za-z_][\w$]*)`;
 const NAME = String.raw`(${IDENT}(?:\s*\.\s*${IDENT})?)`;

package/dist/{rls-BA8an5Ap.js → rls-Ck_PocSp.js}

@@ -1,6 +1,6 @@
-import { c as missingInput } from "./errors-CWTY6uih.js";
+import { c as missingInput } from "./errors-DpP_U6Bf.js";
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { c as given, d as policyFlag, f as validatorFlag, i as dryRunFlag, l as outFlag, n as dbUrl, o as fileOut, r as dbUrlFlags, t as checkFlag } from "./flags-C3DktBDY.js";
+import { c as given, d as policyFlag, f as validatorFlag, i as dryRunFlag, l as outFlag, n as dbUrl, o as fileOut, r as dbUrlFlags, t as checkFlag } from "./flags-aaeRAdiD.js";
 //#region src/cli/commands/rls.ts
 const membershipsFlag = { memberships: {
 	type: "string",
@@ -86,7 +86,7 @@ const shapeFlags = {
 	},
 	fields: {
 		type: "enum",
-		options: ["views"],
+		options: ["views", "mask"],
 		description: "Field security"
 	},
 	"revoke-columns": {
@@ -186,7 +186,7 @@ async function rlsInput(ctx, verb, shape, options) {
 	};
 }
 async function runRls(input) {
-	return (await import("./rls-j6t43t7n.js")).runRls(input);
+	return (await import("./rls-CxBZb4rZ.js")).runRls(input);
 }
 const generate = defineLeaf({
 	flags: {
@@ -209,7 +209,7 @@ const generate = defineLeaf({
 			valueHint: "parts",
 			list: true,
 			async complete() {
-				return (await import("./output-files-B3IZJksC.js")).SPLIT_PARTS;
+				return (await import("./output-files-DPAY7-GX.js")).SPLIT_PARTS;
 			}
 		},
 		"grants-out": {
@@ -222,6 +222,10 @@ const generate = defineLeaf({
 			description: "File for the role_permissions seeds",
 			valueHint: "file"
 		},
+		"no-seeds": {
+			type: "boolean",
+			description: "Do not write the seeds part: the project seeds role_permissions itself"
+		},
 		"backfill-out": {
 			type: "string",
 			description: "File for the rls.customRoles.from copy",
@@ -239,6 +243,7 @@ const generate = defineLeaf({
 			split: given(flags.split),
 			grantsOut: given(flags["grants-out"]),
 			seedsOut: given(flags["seeds-out"]),
+			...flags["no-seeds"] ? { noSeeds: true } : {},
 			...backfillOut === void 0 ? {} : { backfillOut }
 		});
 	}
@@ -278,7 +283,12 @@ const verify = defineLeaf({
 		kind: {
 			type: "enum",
 			options: ["node", "pgtap"],
-			description: "Run the fixtures in Node or emit a pgTAP file"
+			description: "Run the fixtures in Node or write a pgTAP file"
+		},
+		out: {
+			type: "string",
+			description: "With --kind pgtap, the file to write (default supabase/tests/permdock_rls.test.sql)",
+			valueHint: "file"
 		},
 		tree: {
 			type: "boolean",
@@ -291,19 +301,33 @@ const verify = defineLeaf({
 		advisors: {
 			type: "boolean",
 			description: "Run the Supabase security advisors"
+		},
+		ignore: {
+			type: "string",
+			repeatable: true,
+			description: "Accept the finding with this id for one run; rls.verify.ignore is the committed baseline",
+			valueHint: "id"
 		}
 	},
 	async run(ctx, { flags }) {
 		return runRls({
 			...await rlsInput(ctx, "verify", flags, { dbRequired: flags.introspect || flags.tree }),
+			out: fileOut("rls verify", flags.out),
 			fixtures: given(flags.fixtures),
 			format: flags.kind,
 			tree: flags.tree,
 			introspect: flags.introspect,
-			advisors: flags.advisors
+			advisors: flags.advisors,
+			ignore: flags.ignore
 		});
 	}
 });
+const explain = defineLeaf({
+	flags: { ...shapeFlags },
+	async run(ctx, { flags }) {
+		return runRls(await rlsInput(ctx, "explain", flags));
+	}
+});
 const migrate = defineLeaf({
 	flags: {
 		...shapeFlags,
@@ -333,4 +357,4 @@ const migrate = defineLeaf({
 	}
 });
 //#endregion
-export { generate, importPolicies, migrate, verify };
+export { explain, generate, importPolicies, migrate, verify };