permdock 0.5.0 → 0.7.0

package/dist/powersync-bYUDLOAO.js

@@ -1,538 +0,0 @@
-import { c as isConditionRef, s as isConditionDate } from "./refs-K6eWUJ0H.js";
-import { E as memoryCustomRoleSource, f as localSnapshotManifest } from "./src-DLfUWFAI.js";
-import { n as findPermission } from "./permission-registry-Br4jSNVi.js";
-import { d as scopeList, o as resolveScope } from "./scopes-CUPSjo9q.js";
-import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
-import { t as getPermDock } from "./permdock-B9JxkBwC.js";
-import { u as usageResult } from "./errors-CWTY6uih.js";
-import { c as requirePolicy } from "./load-DFS_ry0W.js";
-import { i as scopeMembershipTable, r as scopeColumn } from "./compile-CMqMx_IN.js";
-import { s as quoteSqlLiteral, t as SQL_IDENT } from "./sql-B5T1IL83.js";
-import "./sources-vs5dGOsS.js";
-import { t as applyFiles } from "./files-C5ZI27eV.js";
-import { i as fileDrift } from "./output-files-DhRBBE4n.js";
-import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-B7XrLeY7.js";
-import { N as quoteIdent, a as customRolesOn, t as CUSTOM_ROLES } from "./shared-CD11nBbC.js";
-import { f as pgConnector } from "./policies-CO1oOymN.js";
-import { M as contextRefs, k as collectGrants, t as ownershipRules } from "./ownership-BatFgAA4.js";
-import { m as tableFor, t as canFixture } from "./verify-DbCL9bnB.js";
-import { resolve } from "node:path";
-//#region src/cli/powersync/streams.ts
-function ident(name) {
-	if (!SQL_IDENT.test(name)) throw new TypeError(`PermDock CLI: '${name}' is not a plain identifier, which Sync Streams need`);
-	return name;
-}
-const POWERSYNC = {
-	user: "auth.user_id()",
-	claim: (name) => `auth.parameter(${quoteSqlLiteral(name)})`,
-	claims: (name) => `(SELECT value FROM json_each(auth.parameter(${quoteSqlLiteral(name)})))`,
-	column: (table, name) => `${table}.${ident(name)}`,
-	literal: (value) => typeof value === "string" ? quoteSqlLiteral(value) : String(value)
-};
-const POSTGRES = {
-	user: "$1::text",
-	claim: (name) => `($2::jsonb ->> ${quoteSqlLiteral(name)})`,
-	claims: (name) => `(select jsonb_array_elements_text(case jsonb_typeof($2::jsonb -> ${quoteSqlLiteral(name)}) when 'array' then $2::jsonb -> ${quoteSqlLiteral(name)} else '[]'::jsonb end))`,
-	column: (table, name, numeric) => `${table}.${ident(name)}${numeric === true ? "" : "::text"}`,
-	literal: (value) => typeof value === "number" ? String(value) : quoteSqlLiteral(String(value))
-};
-/** At most this many queries per stream; a wider `or` product is left out rather than truncated. */
-const MAX_QUERIES = 32;
-/** Every combination of one clause list from each input, ANDed. */
-function product(lists) {
-	let out = [[]];
-	for (const list of lists) out = out.flatMap((left) => list.map((right) => left.concat(right)));
-	return out;
-}
-function every(parts) {
-	const out = [];
-	for (const part of parts) {
-		if (part === void 0) return;
-		out.push(part);
-	}
-	return out;
-}
-/** The table as a stream query names it: unqualified in `public`, `schema.table` otherwise. */
-function bare(table) {
-	return (table.startsWith("public.") ? table.slice(7) : table).split(".").map(ident).join(".");
-}
-/** A row value: a literal, or a principal ref the token carries. `undefined` when neither. */
-function valueSql(value, ctx) {
-	if (isConditionRef(value)) {
-		if (value.ref === "principal.id") return ctx.dialect.user;
-		const claim = /^principal\.claims\.([A-Za-z_][A-Za-z0-9_]*)$/u.exec(value.ref)?.[1];
-		return claim === void 0 ? void 0 : ctx.dialect.claim(claim);
-	}
-	if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") return ctx.dialect.literal(value);
-}
-const COMPARE = {
-	eq: "=",
-	ne: "!=",
-	gt: ">",
-	gte: ">=",
-	lt: "<",
-	lte: "<="
-};
-/**
-* A row condition as alternatives of ANDed clauses over `table`. `undefined`
-* when part of it has no Sync Streams form, so the grant syncs nothing.
-*/
-function conditionSql(condition, table, ctx) {
-	const column = (field) => SQL_IDENT.test(field) ? ctx.dialect.column(table, field) : void 0;
-	switch (condition.op) {
-		case "eq":
-		case "ne":
-		case "gt":
-		case "gte":
-		case "lt":
-		case "lte": {
-			const left = typeof condition.value === "number" && SQL_IDENT.test(condition.field) ? ctx.dialect.column(table, condition.field, true) : column(condition.field);
-			if (condition.value === null && left !== void 0) return condition.op === "eq" ? [[`${left} IS NULL`]] : condition.op === "ne" ? [[`${left} IS NOT NULL`]] : void 0;
-			const right = valueSql(condition.value, ctx);
-			return left === void 0 || right === void 0 ? void 0 : [[`${left} ${COMPARE[condition.op]} ${right}`]];
-		}
-		case "isNull": {
-			const left = column(condition.field);
-			return left === void 0 ? void 0 : [[`${left} IS ${condition.value ? "" : "NOT "}NULL`]];
-		}
-		case "in":
-		case "notIn": {
-			const left = column(condition.field);
-			if (left === void 0) return;
-			const negate = condition.op === "notIn" ? "NOT " : "";
-			if (isConditionRef(condition.value)) {
-				const claim = /^principal\.claims\.([A-Za-z_][A-Za-z0-9_]*)$/u.exec(condition.value.ref)?.[1];
-				return claim === void 0 || negate !== "" ? void 0 : [[`${left} IN ${ctx.dialect.claims(claim)}`]];
-			}
-			const values = condition.value.map((value) => isConditionRef(value) || isConditionDate(value) || Array.isArray(value) ? void 0 : value === null ? void 0 : valueSql(value, ctx));
-			if (values.some((value) => value === void 0)) return;
-			return values.length === 0 ? negate === "" ? [] : [[]] : [[`${left} ${negate}IN (${values.join(", ")})`]];
-		}
-		case "and":
-		case "or": {
-			const parts = every(condition.conditions.map((child) => conditionSql(child, table, ctx)));
-			if (parts === void 0) return;
-			return condition.op === "and" ? product(parts) : parts.flat();
-		}
-		case "memberOf": {
-			if (condition.scope === "resource" || condition.parents !== void 0) return;
-			const scope = resolveScope(ctx.scopes, condition.scope);
-			const left = column(condition.field);
-			if (scope === void 0 || left === void 0) return;
-			return membershipSql(scope, left, condition.roles, ctx);
-		}
-		case "not":
-		case "contains":
-		case "related":
-		case "opaque":
-		case "sqlFunction":
-		case "liveSession": return;
-		default: return condition;
-	}
-}
-/** One `IN (SELECT …)` per role source of the membership table: the row's `left` is an instance the user holds `roles` in. */
-function membershipIn(table, idColumn, left, roles, ctx) {
-	if (table.expiresAt !== void 0 || table.disabledAt !== void 0) return;
-	const name = bare(table.table);
-	const sources = Array.isArray(table.role) ? table.role : [table.role];
-	const kinds = [...new Set(roles.flatMap((role) => ctx.kinds[role] ?? []))];
-	const restricted = roles.some((role) => ctx.kinds[role] !== void 0);
-	if (restricted && (table.via === void 0 || roles.length !== 1)) return;
-	const via = table.via;
-	if (restricted && typeof via === "object" && !kinds.includes(via.value)) return [];
-	const filters = [`${ctx.dialect.column(name, table.user)} = ${ctx.dialect.user}`, ...restricted && typeof via === "string" ? [`${ctx.dialect.column(name, via)} IN (${kinds.map((kind) => ctx.dialect.literal(kind)).join(", ")})`] : []];
-	const list = roles.map((role) => ctx.dialect.literal(role)).join(", ");
-	return sources.map((source) => {
-		if (typeof source === "string") return [`${left} IN (SELECT ${ctx.dialect.column(name, idColumn)} FROM ${name} WHERE ${[...filters, `${ctx.dialect.column(name, source)} IN (${list})`].join(" AND ")})`];
-		const [pair] = Object.entries(source.on);
-		const keys = bare(source.through);
-		const [ref, id] = pair ?? ["", ""];
-		return [`${left} IN (SELECT ${ctx.dialect.column(name, idColumn)} FROM ${name} INNER JOIN ${keys} ON ${ctx.dialect.column(keys, id)} = ${ctx.dialect.column(name, ref)} WHERE ${[...filters, `${ctx.dialect.column(keys, source.column)} IN (${list})`].join(" AND ")})`];
-	});
-}
-function membershipSql(scope, left, roles, ctx) {
-	const table = scopeMembershipTable(ctx.config.rls?.memberships, ctx.scopes, scope);
-	const idColumn = table === void 0 ? void 0 : scopeColumn(table, ctx.scopes, scope);
-	return table === void 0 || idColumn === void 0 ? void 0 : membershipIn(table, idColumn, left, roles, ctx);
-}
-/** Who the grant reaches, as alternatives of clauses; `undefined` when Sync Streams cannot express it. */
-function accessSql(item, table, ctx) {
-	const { access } = item;
-	switch (access.kind) {
-		case "anyone":
-		case "authenticated": return [[]];
-		case "role": {
-			if (access.scope === "global") return `global role ${access.role} is not a row filter`;
-			const field = ctx.policy.scopes.find((scope) => scope.name === access.scope)?.key;
-			if (field === void 0 || !SQL_IDENT.test(field)) return `scope ${access.scope} has no row key`;
-			return membershipSql(access.scope, ctx.dialect.column(table, field), [access.role], ctx) ?? `no rls.memberships table without an expiry or disabledAt and with the kinds of ${access.role} for scope ${access.scope}`;
-		}
-		case "resource": {
-			const holder = ctx.config.rls?.memberships?.resource?.[access.resource];
-			const node = ctx.policy.resources.get(item.grant.permission.resource);
-			const field = node?.name === access.resource ? node.id : node?.parent?.resource === access.resource ? node.parent.field : void 0;
-			if (holder === void 0 || field === void 0 || !SQL_IDENT.test(field)) return `no rls.memberships.resource table for ${access.resource} on the row`;
-			return membershipIn(holder, holder.id ?? "id", ctx.dialect.column(table, field), [access.role], ctx) ?? `the ${access.resource} memberships table has an expiry or disabledAt, or lacks via`;
-		}
-		case "actor": return "actor grantees are not in the sync token";
-		default: return access;
-	}
-}
-/** `permdock_<table>`, with a schema joined by `_`; a table in the `permdock` schema keeps one prefix. */
-function subjectStreamName(table) {
-	const name = table.replaceAll(".", "_");
-	return name.startsWith("permdock_") ? name : `permdock_${name}`;
-}
-function roleThroughs(role) {
-	return (Array.isArray(role) ? role : [role]).filter((item) => typeof item === "object" && item !== null);
-}
-/**
-* Streams of the rows a device builds the user's snapshot from: the user's
-* own membership and global-role rows, the roles tables they reference, and
-* the custom roles of the user's tenants. Each query starts from the user's
-* own rows.
-*/
-function subjectStreams(ctx) {
-	const rls = ctx.config.rls;
-	const { dialect } = ctx;
-	const tables = /* @__PURE__ */ new Map();
-	const add = (table, query, user) => {
-		const entry = tables.get(table) ?? {
-			user: void 0,
-			queries: /* @__PURE__ */ new Set()
-		};
-		if (entry.queries.size === 0) entry.user = user;
-		else if (entry.user !== user) entry.user = void 0;
-		entry.queries.add(query);
-		tables.set(table, entry);
-	};
-	const own = (table, user, role) => {
-		const name = bare(table);
-		const mine = `${dialect.column(name, user)} = ${dialect.user}`;
-		add(name, `SELECT * FROM ${name} WHERE ${mine}`, user);
-		for (const through of roleThroughs(role)) {
-			const keys = bare(through.through);
-			const [pair] = Object.entries(through.on);
-			if (pair === void 0) continue;
-			const [ref, id] = pair;
-			add(keys, `SELECT * FROM ${keys} WHERE ${dialect.column(keys, id)} IN (SELECT ${dialect.column(name, ref)} FROM ${name} WHERE ${mine})`);
-		}
-	};
-	const memberships = rls?.memberships;
-	for (const table of [
-		...Object.values(memberships?.scopes ?? {}),
-		...memberships?.tenant === void 0 ? [] : [memberships.tenant],
-		...memberships?.team === void 0 ? [] : [memberships.team],
-		...Object.values(memberships?.resource ?? {})
-	]) own(table.table, table.user, table.role);
-	const schema = rls?.schema ?? "permdock";
-	const database = rls?.authorize === "database";
-	const globalRoles = rls?.roles ?? (database ? { table: `${schema}.user_roles` } : void 0);
-	if (globalRoles !== void 0) own(globalRoles.table, globalRoles.user ?? "user_id", globalRoles.role ?? "role");
-	if (database && customRolesOn(rls)) {
-		const root = ctx.scopes[0]?.name;
-		const tenants = root === void 0 ? void 0 : scopeMembershipTable(memberships, ctx.scopes, root);
-		const column = tenants === void 0 || root === void 0 ? void 0 : scopeColumn(tenants, ctx.scopes, root);
-		for (const name of [CUSTOM_ROLES.permissions, CUSTOM_ROLES.includes]) {
-			const table = bare(`${schema}.${name}`);
-			const tenant = dialect.column(table, "tenant_id");
-			add(table, `SELECT * FROM ${table} WHERE ${tenant} IS NULL`);
-			if (tenants !== void 0 && column !== void 0) {
-				const members = bare(tenants.table);
-				add(table, `SELECT * FROM ${table} WHERE ${tenant} IN (SELECT ${dialect.column(members, column)} FROM ${members} WHERE ${dialect.column(members, tenants.user)} = ${dialect.user})`);
-			}
-		}
-	}
-	const out = [];
-	for (const [table, entry] of tables) {
-		const name = subjectStreamName(table);
-		const queries = [...entry.queries];
-		out.push(entry.user === void 0 ? {
-			name,
-			table,
-			queries
-		} : {
-			name,
-			table,
-			user: entry.user,
-			queries
-		});
-	}
-	return out;
-}
-/** Why a grant cannot become a stream query, before its conditions are compiled. */
-function unsupported(item) {
-	const { grant } = item;
-	if (grant.breakGlass !== void 0) return "break-glass";
-	if (grant.closure !== void 0 || grant.portable === false) return "not portable";
-	if (requiresApproval(grant.approval)) return "needs approval";
-	if (grant.validity !== void 0) return "time-bounded";
-	const context = contextRefs(item.where);
-	return context.length > 0 ? `reads ${context.join(", ")}` : void 0;
-}
-/**
-* Sync Streams for each synced resource: the union of the rows its read
-* permission's allow grants reach. A grant with any part Sync Streams cannot
-* express syncs nothing, and a resource with a deny grant gets no stream, so
-* a stream never holds a row the policy denies.
-*/
-function powersyncPlan(policy, config, dialect = POWERSYNC) {
-	const scopes = scopeList(policy.scopes);
-	const ctx = {
-		policy,
-		config,
-		scopes,
-		kinds: ownershipRules(policy, scopes)?.kinds ?? {},
-		dialect
-	};
-	const action = config.powersync?.action ?? "read";
-	const grants = collectGrants(policy);
-	const resources = config.powersync?.resources ?? [...policy.resources.keys()].filter((name) => grants.some((item) => item.grant.permission.resource === name && item.grant.permission.action === action));
-	const streams = [];
-	const omitted = [];
-	const warnings = [];
-	for (const resource of resources) {
-		const node = policy.resources.get(resource);
-		const key = `${resource}.${action}`;
-		const items = grants.filter((item) => item.grant.permission.key === key);
-		if (node === void 0 || items.length === 0) {
-			omitted.push({
-				resource,
-				reason: `no grant of ${key}`
-			});
-			continue;
-		}
-		if (items.some((item) => item.grant.effect === "deny")) {
-			omitted.push({
-				resource,
-				reason: `${key} has a deny grant, which Sync Streams cannot subtract`
-			});
-			continue;
-		}
-		const table = bare(tableFor(resource, config.rls?.tables));
-		const { id } = node;
-		const queries = /* @__PURE__ */ new Set();
-		for (const item of items) {
-			const label = `${item.label}/${key}`;
-			const access = unsupported(item) ?? accessSql(item, table, ctx);
-			if (typeof access === "string") {
-				warnings.push(`${label} does not sync: ${access}`);
-				continue;
-			}
-			const where = item.where === void 0 ? [[]] : conditionSql(item.where, table, ctx);
-			if (where === void 0) {
-				warnings.push(`${label} does not sync: its condition has no Sync Streams form`);
-				continue;
-			}
-			const columns = item.grant.fields === void 0 ? "*" : [.../* @__PURE__ */ new Set([id, ...item.grant.fields])].map((field) => ctx.dialect.column(table, field)).join(", ");
-			for (const clauses of product([access, where])) queries.add(`SELECT ${columns} FROM ${table}${clauses.length === 0 ? "" : ` WHERE ${clauses.join(" AND ")}`}`);
-		}
-		if (queries.size === 0) omitted.push({
-			resource,
-			reason: `no grant of ${key} compiles`
-		});
-		else if (queries.size > MAX_QUERIES) omitted.push({
-			resource,
-			reason: `${String(queries.size)} queries, over the limit of ${String(MAX_QUERIES)}`
-		});
-		else streams.push({
-			name: resource,
-			resource,
-			table,
-			id,
-			queries: [...queries]
-		});
-	}
-	return {
-		streams,
-		subject: subjectStreams(ctx),
-		omitted,
-		warnings
-	};
-}
-/** `sync-config.yaml`: edition 3 Sync Streams, one auto-subscribed stream per synced resource. */
-function powersyncYaml(plan) {
-	const lines = [
-		"# Generated by permdock powersync generate from the policy. Do not edit.",
-		"config:",
-		"  edition: 3",
-		"",
-		"streams:"
-	];
-	if (plan.streams.length === 0 && plan.subject.length === 0) lines[lines.length - 1] = "streams: {}";
-	for (const stream of [...plan.streams, ...plan.subject]) lines.push(`  ${stream.name}:`, "    auto_subscribe: true", "    queries:", ...stream.queries.map((query) => `      - ${JSON.stringify(query)}`));
-	for (const item of plan.omitted) lines.push(`# ${item.resource}: not synced, ${item.reason}`);
-	return `${lines.join("\n")}\n`;
-}
-//#endregion
-//#region src/cli/powersync/powersync.ts
-const POWERSYNC_HELP = `permdock powersync generate [--out sync-config.yaml] [--check]
-permdock powersync verify [--db-url-stdin] [--fixtures rls.fixtures.json]`;
-const DEFAULT_OUT = "sync-config.yaml";
-function powersyncOut(config, out) {
-	return out ?? config.powersync?.out ?? DEFAULT_OUT;
-}
-function loadPolicy(cwd, config, from) {
-	return requirePolicy(cwd, from ?? config.policy, "powersync needs policy in the config or --policy");
-}
-function sameJson(current, expected) {
-	try {
-		return JSON.stringify(JSON.parse(current)) === JSON.stringify(JSON.parse(expected));
-	} catch {
-		return false;
-	}
-}
-/**
-* The files the policy compiles to: the Sync Streams file and, with
-* `powersync.manifest`, the local-snapshot manifest. `warnings` lists the
-* grants that do not sync.
-*/
-function powersyncFiles(policy, config, out) {
-	const plan = powersyncPlan(policy, config);
-	const files = [{
-		path: powersyncOut(config, out),
-		text: powersyncYaml(plan)
-	}];
-	const manifest = config.powersync?.manifest;
-	if (manifest !== void 0) files.push({
-		path: manifest,
-		json: true,
-		text: `${JSON.stringify(localSnapshotManifest(policy), null, 2)}\n`
-	});
-	return {
-		files,
-		warnings: plan.warnings
-	};
-}
-/** The files whose content on disk is not what the policy compiles to, with `missing` for an absent one. */
-function staleFiles(cwd, files) {
-	const stale = [];
-	for (const file of files) {
-		const found = fileDrift(resolve(cwd, file.path), file.text, file.json === true ? sameJson : void 0);
-		if (found !== void 0) stale.push({
-			path: file.path,
-			missing: found.kind === "missing"
-		});
-	}
-	return stale;
-}
-function rowValue(row, key) {
-	const value = key !== void 0 && row !== null && typeof row === "object" && !Array.isArray(row) ? Object.entries(row).find(([name]) => name === key)?.[1] : void 0;
-	return value === void 0 || value === null ? void 0 : String(value);
-}
-function claimsJson(fixture) {
-	return JSON.stringify(fixture.subject.claims ?? {});
-}
-/** Whether a stream of the user's own rows holds a row of another user. */
-async function leaks(query, stream, user, fixture) {
-	for (const text of stream.queries) if ((await query(`select 1 from (${text}) q where q.${quoteIdent(user)}::text is distinct from $1::text and $2::jsonb is not null limit 1`, [fixture.subject.id, claimsJson(fixture)])).length > 0) return true;
-	return false;
-}
-/** Whether the stream holds the fixture's row for its subject. */
-async function synced(query, stream, fixture) {
-	const value = rowValue(fixture.row, stream.id);
-	if (value === void 0) return false;
-	for (const text of stream.queries) if ((await query(`select 1 from (${text}) q where q.${quoteIdent(stream.id)}::text = $3::text and $1::text is not null and $2::jsonb is not null limit 1`, [
-		fixture.subject.id,
-		claimsJson(fixture),
-		value
-	])).length > 0) return true;
-	return false;
-}
-async function verifyStreams(input) {
-	const plan = powersyncPlan(input.policy, input.config, POSTGRES);
-	const mismatches = [];
-	const notes = [];
-	const client = await input.connect(input.db);
-	const query = async (sql, values) => (await client.query(sql, values)).rows;
-	const root = input.policy.scopes.find((scope) => scope.within === void 0)?.key;
-	try {
-		const checked = /* @__PURE__ */ new Set();
-		for (const fixture of input.fixtures) {
-			if (checked.has(fixture.subject.id)) continue;
-			checked.add(fixture.subject.id);
-			for (const stream of plan.subject) if (stream.user !== void 0 && await leaks(query, stream, stream.user, fixture)) mismatches.push(`stream ${stream.name} syncs another user's ${stream.table} rows to ${fixture.subject.id}`);
-		}
-		for (const fixture of input.fixtures) {
-			const permission = findPermission(input.policy.permissions, fixture.action);
-			const stream = plan.streams.find((item) => permission !== void 0 && item.resource === permission.resource && permission.action === (input.config.powersync?.action ?? "read"));
-			if (permission === void 0 || stream === void 0) continue;
-			const tenant = rowValue(fixture.row, root);
-			const permdock = await getPermDock(input.policy, fixtureSubject({
-				...fixture.subject,
-				...tenant === void 0 ? {} : { tenant }
-			}), { customRoles: memoryCustomRoleSource(input.customRoles) });
-			const granted = canFixture(permdock, permission, fixtureRow(fixture, permission.kind));
-			const holds = await synced(query, stream, fixture);
-			if (holds && !granted) mismatches.push(`${fixture.action} for ${fixture.subject.id}: stream ${stream.name} syncs a row the policy denies`);
-			else if (granted && !holds) notes.push(`${fixture.action} for ${fixture.subject.id}: granted, not synced (the app reads it from the server)`);
-		}
-	} finally {
-		await client.end();
-	}
-	return {
-		mismatches,
-		notes
-	};
-}
-async function runPowerSync(input) {
-	const [verb] = input.rest;
-	if (verb !== "generate" && verb !== "verify") return {
-		code: 2,
-		output: POWERSYNC_HELP
-	};
-	let policy;
-	let compiled;
-	try {
-		policy = await loadPolicy(input.cwd, input.config, input.from);
-		compiled = powersyncFiles(policy, input.config, input.out);
-	} catch (cause) {
-		return usageResult(cause);
-	}
-	const { files, warnings } = compiled;
-	const out = powersyncOut(input.config, input.out);
-	const stale = staleFiles(input.cwd, files);
-	if (verb === "generate") {
-		if (input.check) return stale.length === 0 ? {
-			code: 0,
-			output: files.map((file) => `${file.path} is current`).join("\n")
-		} : {
-			code: 1,
-			output: stale.map((file) => `${file.path} is stale: run permdock powersync generate`).join("\n")
-		};
-		applyFiles(input.cwd, files);
-		return {
-			code: 0,
-			output: [...files.map((file) => `wrote ${file.path}`), ...warnings].join("\n")
-		};
-	}
-	const mismatches = stale.map((file) => `${file.path} ${file.missing ? "is missing" : "differs from the policy"}: run permdock powersync generate`);
-	const notes = [...warnings];
-	if (input.db !== void 0) try {
-		const fixturesPath = input.fixtures ?? input.config.rls?.fixtures ?? "rls.fixtures.json";
-		const { fixtures, customRoles } = await loadFixtures(input.cwd, fixturesPath);
-		const database = await verifyStreams({
-			policy,
-			config: input.config,
-			fixtures,
-			customRoles,
-			db: input.db,
-			connect: input.connect ?? pgConnector("permdock powersync verify --db-url-stdin", input.cwd)
-		});
-		mismatches.push(...database.mismatches);
-		notes.push(...database.notes);
-	} catch (cause) {
-		return usageResult(cause);
-	}
-	if (mismatches.length > 0) return {
-		code: 1,
-		output: [...mismatches, ...notes].join("\n")
-	};
-	const verified = input.db === void 0 ? `${out} matches the policy` : `${out} matches the policy; no stream syncs a row the fixtures deny`;
-	return {
-		code: 0,
-		output: notes.length === 0 ? verified : `${verified}\n${notes.join("\n")}`
-	};
-}
-//#endregion
-export { runPowerSync as n, staleFiles as r, powersyncFiles as t };

package/dist/prompt-DfZLJLIn.js

@@ -1,32 +0,0 @@
-import { cancel, confirm, isCancel, multiselect } from "@clack/prompts";
-//#region src/cli/core/prompt.ts
-/** What a command reports when the person at the terminal cancels a prompt. */
-const CANCELLED = {
-	code: 130,
-	output: "Cancelled."
-};
-/** A yes or no question; `undefined` when cancelled. */
-async function ask(message) {
-	const answer = await confirm({ message });
-	if (isCancel(answer)) {
-		cancel();
-		return;
-	}
-	return answer;
-}
-/** Pick one or more of `options`, `initial` preselected; `undefined` when cancelled. */
-async function pick(message, options, initial) {
-	const answer = await multiselect({
-		message,
-		options: options.map((option) => ({ ...option })),
-		initialValues: [...initial],
-		required: true
-	});
-	if (isCancel(answer)) {
-		cancel();
-		return;
-	}
-	return answer;
-}
-//#endregion
-export { ask as n, pick as r, CANCELLED as t };

package/dist/pull-ByOks_Tg.js

@@ -1 +0,0 @@
-export { n as runCloudPull } from "./pull-BgIfno6w.js";

package/dist/run-CNsApDpd.js

@@ -1 +0,0 @@
-export { t as run } from "./run-DOfMtc9V.js";

package/dist/supabase-hook-CXcGpHqq.js

@@ -1 +0,0 @@
-export { i as runSupabase } from "./supabase-hook-DdDQhMlw.js";

package/dist/supautils-B6HYL9eL.js

@@ -1,91 +0,0 @@
-import { i as group, o as sqlStatements } from "./deciding-columns-Sq12mEA6.js";
-//#region src/cli/sql/supautils.ts
-/** `supautils.reserved_roles` of supabase/postgres 17.11.0.002 (supautils 3.4.4). */
-const RESERVED_ROLES = /* @__PURE__ */ new Set([
-	"supabase_admin",
-	"supabase_auth_admin",
-	"supabase_storage_admin",
-	"supabase_read_only_user",
-	"supabase_realtime_admin",
-	"supabase_replication_admin",
-	"supabase_etl_admin",
-	"supabase_privileged_role",
-	"dashboard_user",
-	"pgbouncer",
-	"service_role",
-	"authenticator",
-	"authenticated",
-	"anon"
-]);
-/** The `*` entries of `reserved_roles`: `postgres` may still `set` or `reset` their settings. */
-const CONFIGURABLE_ROLES = /* @__PURE__ */ new Set([
-	"service_role",
-	"authenticator",
-	"authenticated",
-	"anon"
-]);
-/** `supautils.reserved_memberships` of the same image. */
-const RESERVED_MEMBERSHIPS = /* @__PURE__ */ new Set([
-	"pg_read_server_files",
-	"pg_write_server_files",
-	"pg_execute_server_program",
-	"supabase_admin",
-	"supabase_auth_admin",
-	"supabase_storage_admin",
-	"supabase_read_only_user",
-	"supabase_realtime_admin",
-	"supabase_replication_admin",
-	"supabase_etl_admin",
-	"dashboard_user",
-	"pgbouncer",
-	"authenticator"
-]);
-const ROLE = String.raw`(?:"[^"]+"|\w+)`;
-const ROLES = String.raw`${ROLE}(?:\s*,\s*${ROLE})*`;
-const ALTER_ROLE = new RegExp(String.raw`^alter\s+(role|user|group)\s+(${ROLE})\s+([\s\S]*)$`, "iu");
-const DROP_ROLE = new RegExp(String.raw`^drop\s+(?:role|user|group)\s+(?:if\s+exists\s+)?(${ROLES})\s*$`, "iu");
-const GRANT_ROLE = /^grant\s+([\s\S]+?)\s+to\s/iu;
-const CREATE_IN_ROLE = new RegExp(String.raw`^create\s+(?:role|user|group)\s+${ROLE}\b[\s\S]*?\bin\s+(?:role|group)\s+(${ROLES})`, "iu");
-const CONFIG_CHANGE = /^(?:in\s+database\s+\S+\s+)?(?:set|reset)\s/iu;
-function roleName(name) {
-	return name.replaceAll("\"", "").toLowerCase();
-}
-function roleList(list) {
-	return list.split(",").map((name) => roleName(name.trim()));
-}
-function rejection(text) {
-	const alter = ALTER_ROLE.exec(text);
-	if (alter !== null) {
-		const role = roleName(group(alter, 2));
-		const rest = group(alter, 3);
-		if (group(alter, 1).toLowerCase() === "group" && /^add\s/iu.test(rest)) return RESERVED_MEMBERSHIPS.has(role) ? `grants membership in the reserved role ${role}` : void 0;
-		if (!RESERVED_ROLES.has(role) || CONFIGURABLE_ROLES.has(role) && CONFIG_CHANGE.test(rest)) return;
-		return `changes the reserved role ${role}`;
-	}
-	const drop = DROP_ROLE.exec(text);
-	if (drop !== null) {
-		const role = roleList(group(drop, 1)).find((name) => RESERVED_ROLES.has(name));
-		return role === void 0 ? void 0 : `drops the reserved role ${role}`;
-	}
-	const grant = GRANT_ROLE.exec(text);
-	const granted = CREATE_IN_ROLE.exec(text)?.[1] ?? (grant === null || /\bon\b/iu.test(group(grant, 1)) ? void 0 : group(grant, 1));
-	if (granted === void 0) return;
-	const role = roleList(granted).find((name) => RESERVED_MEMBERSHIPS.has(name));
-	return role === void 0 ? void 0 : `grants membership in the reserved role ${role}`;
-}
-/**
-* The statements of `sql` that supautils rejects for a non-superuser:
-* changing or dropping a reserved role, other than `set` or `reset` on the
-* four API roles, and granting a reserved membership.
-*/
-function supautilsRejections(sql) {
-	return sqlStatements(sql).flatMap(({ line, text }) => {
-		const reason = rejection(text);
-		return reason === void 0 ? [] : [{
-			line,
-			reason
-		}];
-	});
-}
-//#endregion
-export { supautilsRejections as t };

package/dist/text-diff-BQcUapOb.js

@@ -1,15 +0,0 @@
-import { createTwoFilesPatch } from "diff";
-//#region src/cli/core/text-diff.ts
-const MAX_LINES = 40;
-/**
-* A unified diff from the file on disk to what the command would write,
-* cut to the first {@link MAX_LINES} lines so a CI log stays readable.
-*/
-function shortDiff(file, onDisk, next) {
-	const lines = createTwoFilesPatch(`${file} (on disk)`, `${file} (generated)`, onDisk, next, void 0, void 0, { context: 2 }).split("\n").filter((line) => !line.startsWith("=====")).filter((line, index, all) => line !== "" || index < all.length - 1);
-	if (lines.length <= MAX_LINES) return lines.join("\n");
-	const rest = lines.length - MAX_LINES;
-	return [...lines.slice(0, MAX_LINES), `… ${rest} more diff line${rest === 1 ? "" : "s"}`].join("\n");
-}
-//#endregion
-export { shortDiff as t };