permdock 0.6.0 → 0.8.0

package/dist/generate-CNU1pIOo.js

@@ -1,171 +0,0 @@
-import { r as isRecord } from "./compact-CAf557ZB.js";
-import { t as byCodePoint } from "./compare-pfyVnBjE.js";
-//#region src/cli/generate.ts
-const IDENTIFIER = /^[A-Za-z_$][A-Za-z0-9_$]*$/u;
-const MAX_DEPTH = 6;
-function isSchemaKind(value) {
-	return value === "zod" || value === "valibot" || value === "arktype";
-}
-function schemaImport(kind) {
-	switch (kind) {
-		case "zod": return "import { z } from 'zod'";
-		case "valibot": return "import * as v from 'valibot'";
-		case "arktype": return "import { type } from 'arktype'";
-		default: return kind;
-	}
-}
-function emptySchema(kind) {
-	return schemaExpression(kind, { type: "object" });
-}
-function propertyKey(name) {
-	return IDENTIFIER.test(name) ? name : JSON.stringify(name);
-}
-function literalEnum(schema) {
-	const values = schema["enum"];
-	if (!Array.isArray(values) || values.length === 0 || !values.every((value) => typeof value === "string")) return;
-	return values;
-}
-function schemaType(schema) {
-	const type = schema["type"];
-	if (typeof type === "string") return type;
-	if (Array.isArray(type)) {
-		const named = type.filter((item) => item !== "null");
-		return named.length === 1 && typeof named[0] === "string" ? named[0] : void 0;
-	}
-	return isRecord(schema["properties"]) ? "object" : void 0;
-}
-function zodOf(schema, resolve, depth) {
-	const node = resolve(schema);
-	const values = literalEnum(node);
-	if (values !== void 0) return `z.enum(${JSON.stringify(values)})`;
-	const type = depth > MAX_DEPTH ? void 0 : schemaType(node);
-	if (type === void 0) return "z.unknown()";
-	switch (type) {
-		case "string": return "z.string()";
-		case "number": return "z.number()";
-		case "integer": return "z.number().int()";
-		case "boolean": return "z.boolean()";
-		case "array": return `z.array(${isRecord(node["items"]) ? zodOf(node["items"], resolve, depth + 1) : "z.unknown()"})`;
-		case "object": {
-			const required = new Set(Array.isArray(node["required"]) ? node["required"] : []);
-			const properties = isRecord(node["properties"]) ? node["properties"] : {};
-			const fields = Object.entries(properties).filter((entry) => isRecord(entry[1])).map(([name, child]) => {
-				const expression = zodOf(child, resolve, depth + 1);
-				return `${propertyKey(name)}: ${required.has(name) ? expression : `${expression}.optional()`}`;
-			});
-			return `z.object({${fields.length === 0 ? "" : ` ${fields.join(", ")} `}})`;
-		}
-		default: return "z.unknown()";
-	}
-}
-function valibotOf(schema, resolve, depth) {
-	const node = resolve(schema);
-	const values = literalEnum(node);
-	if (values !== void 0) return `v.picklist(${JSON.stringify(values)})`;
-	const type = depth > MAX_DEPTH ? void 0 : schemaType(node);
-	if (type === void 0) return "v.unknown()";
-	switch (type) {
-		case "string": return "v.string()";
-		case "number": return "v.number()";
-		case "integer": return "v.pipe(v.number(), v.integer())";
-		case "boolean": return "v.boolean()";
-		case "array": return `v.array(${isRecord(node["items"]) ? valibotOf(node["items"], resolve, depth + 1) : "v.unknown()"})`;
-		case "object": {
-			const required = new Set(Array.isArray(node["required"]) ? node["required"] : []);
-			const properties = isRecord(node["properties"]) ? node["properties"] : {};
-			const fields = Object.entries(properties).filter((entry) => isRecord(entry[1])).map(([name, child]) => {
-				const expression = valibotOf(child, resolve, depth + 1);
-				return `${propertyKey(name)}: ${required.has(name) ? expression : `v.optional(${expression})`}`;
-			});
-			return `v.object({${fields.length === 0 ? "" : ` ${fields.join(", ")} `}})`;
-		}
-		default: return "v.unknown()";
-	}
-}
-/** An arktype definition: a string keyword or an object literal. */
-function arktypeOf(schema, resolve, depth) {
-	const node = resolve(schema);
-	const values = literalEnum(node);
-	if (values !== void 0) return JSON.stringify(values.map((value) => `'${value.replaceAll("'", "\\'")}'`).join(" | "));
-	const type = depth > MAX_DEPTH ? void 0 : schemaType(node);
-	if (type === void 0) return "'unknown'";
-	switch (type) {
-		case "string": return "'string'";
-		case "number": return "'number'";
-		case "integer": return "'number.integer'";
-		case "boolean": return "'boolean'";
-		case "array": {
-			if (!isRecord(node["items"])) return "'unknown[]'";
-			const item = arktypeOf(node["items"], resolve, depth + 1);
-			return item.startsWith("'") && !item.includes("|") ? `'${item.slice(1, -1)}[]'` : `[${item}, '[]']`;
-		}
-		case "object": {
-			const required = new Set(Array.isArray(node["required"]) ? node["required"] : []);
-			const properties = isRecord(node["properties"]) ? node["properties"] : {};
-			const fields = Object.entries(properties).filter((entry) => isRecord(entry[1])).map(([name, child]) => `${JSON.stringify(required.has(name) ? name : `${name}?`)}: ${arktypeOf(child, resolve, depth + 1)}`);
-			return `{${fields.length === 0 ? "" : ` ${fields.join(", ")} `}}`;
-		}
-		default: return "'unknown'";
-	}
-}
-/**
-* A validator expression for a JSON Schema object. Only the portable core
-* (primitives, enums of strings, arrays, objects with `required`) is
-* translated; anything else becomes the validator's `unknown`.
-*/
-function schemaExpression(kind, schema, resolve = (node) => node) {
-	switch (kind) {
-		case "zod": return zodOf(schema, resolve, 0);
-		case "valibot": return valibotOf(schema, resolve, 0);
-		case "arktype": return `type(${arktypeOf(schema, resolve, 0)})`;
-		default: return kind;
-	}
-}
-function renderList(value, indent) {
-	if (Array.isArray(value)) return JSON.stringify(value);
-	return JSON.stringify(value, null, 2).replaceAll("\n", `\n${indent}`);
-}
-function renderResource(resource, indent) {
-	const inner = `${indent}  `;
-	const options = [
-		`${inner}id: '${(resource.id ?? "id").replaceAll("\\", "\\\\").replaceAll("'", "\\'")}',`,
-		`${inner}actions: ${renderList(resource.actions, inner)},`,
-		`${inner}collection: ${renderList(resource.collection, inner)},`
-	].join("\n");
-	return `${resource.schema === void 0 ? "resource({" : `resource(${resource.schema}, {`}\n${options}\n${indent}})`;
-}
-function insert(trie, resource) {
-	let node = trie;
-	for (const [index, segment] of resource.path.entries()) {
-		if (index === resource.path.length - 1) {
-			node.set(segment, resource);
-			return;
-		}
-		const next = node.get(segment);
-		if (next instanceof Map) node = next;
-		else {
-			const created = /* @__PURE__ */ new Map();
-			node.set(segment, created);
-			node = created;
-		}
-	}
-}
-function renderTrie(trie, indent) {
-	return [...trie.entries()].toSorted(([a], [b]) => byCodePoint(a, b)).map(([segment, value]) => value instanceof Map ? `${indent}${propertyKey(segment)}: {\n${renderTrie(value, `${indent}  `)}\n${indent}},` : `${indent}${propertyKey(segment)}: ${renderResource(value, indent)},`).join("\n");
-}
-/** A deterministic `definePermissions()` module with a `// @generated` header. */
-function emitPermissionsModule(input) {
-	const trie = /* @__PURE__ */ new Map();
-	for (const resource of input.resources) insert(trie, resource);
-	const imports = ["import { definePermissions, resource } from 'permdock'", ...input.schema === void 0 ? [] : [schemaImport(input.schema)]];
-	const extras = Object.entries(input.exports ?? {}).map(([name, value]) => `export const ${name} = ${JSON.stringify(value, null, 2)} as const\n\n`);
-	return `// @generated by permdock ${input.generator}
-${imports.join("\n")}
-
-${extras.join("")}export const permissions = definePermissions({
-${renderTrie(trie, "  ")}
-})
-`;
-}
-//#endregion
-export { schemaExpression as i, emptySchema as n, isSchemaKind as r, emitPermissionsModule as t };

package/dist/headers-BIjfMaoC.js

@@ -1,8 +0,0 @@
-import { t as approvalHeaderValue } from "./approval-header-CJACtHkv.js";
-//#region src/client/headers.ts
-/** The `PermDock-Approval` header for a resume; a `TypeError` for a token that is not an RFC 9651 sf-token. */
-function approvalHeaders(token) {
-	return { "PermDock-Approval": approvalHeaderValue(token) };
-}
-//#endregion
-export { approvalHeaders as t };

package/dist/headers-CIbDTUTK.d.ts

@@ -1,7 +0,0 @@
-//#region src/client/headers.d.ts
-/** The `PermDock-Approval` header for a resume; a `TypeError` for a token that is not an RFC 9651 sf-token. */
-declare function approvalHeaders(token: string): {
-  readonly "PermDock-Approval": string;
-};
-//#endregion
-export { approvalHeaders as t };

package/dist/index-Cp_ilKi1.d.ts

@@ -1,91 +0,0 @@
-import { T as Policy, rr as Principal, ut as TokenSigner } from "./policy-types-n0uRTsW8.js";
-import { E as SsfPermDockOptions, T as SsfPermDock, _ as SetSubject, c as PushSetOptions, d as SetDelivery, g as SetQueue, h as SetPollHandlerOptions, m as SetEvent, t as CaepCommon, v as SignSetOptions } from "./types-C791HFu9.js";
-//#region src/ssf/create.d.ts
-declare function createPermDock<TUser, TPrincipal extends Principal = Principal>(policy: Policy<TUser, TPrincipal>, options: SsfPermDockOptions): SsfPermDock;
-//#endregion
-//#region src/ssf/set-queue.d.ts
-/**
- * An in-process `SetQueue`: pending SETs per stream in insertion order. A
- * process restart loses them; a deployment with more than one instance needs
- * a shared queue.
- */
-declare function memorySetQueue(): SetQueue;
-/**
- * The RFC 8936 poll endpoint over a `SetQueue`. It applies the request's
- * `acks` and `setErrs`, then answers `{ sets, moreAvailable }` with up to
- * `maxEvents` pending SETs. It answers at once whatever `returnImmediately`
- * says, which RFC 8936 section 2.4 allows.
- */
-declare function setPollHandler(options: SetPollHandlerOptions): (request: Request) => Promise<Response>;
-//#endregion
-//#region src/ssf/transmitter.d.ts
-/** SSF 1.0 delivery method URN for RFC 8935 push. */
-declare const SSF_PUSH_DELIVERY = "urn:ietf:rfc:8935";
-/** SSF 1.0 delivery method URN for RFC 8936 poll. */
-declare const SSF_POLL_DELIVERY = "urn:ietf:rfc:8936";
-/**
- * Signs one event as an RFC 8417 Security Event Token (`typ: secevent+jwt`):
- * `sub_id` is the event's subject and `events` holds exactly one entry, as
- * SSF 1.0 requires. `iss` is the signer's own.
- */
-declare function signSet(event: SetEvent, signer: TokenSigner, options: SignSetOptions): Promise<string>;
-/**
- * Pushes one SET to a receiver (RFC 8935). A `2xx` is delivery; a `400`
- * maps the receiver's `err` to a cause; `401` and `403` are
- * `authentication-failed` and `access-denied`; a network failure, a timeout,
- * a `429` or a `5xx` is `unavailable` with `retry: true`. Never throws.
- */
-declare function pushSet(set: string, options: PushSetOptions): Promise<SetDelivery>;
-type CaepCredentialChange = CaepCommon & {
-  readonly credentialType: string;
-  readonly changeType: "create" | "revoke" | "update" | "delete";
-  readonly friendlyName?: string;
-  readonly x509Issuer?: string;
-  readonly x509Serial?: string;
-  readonly fido2Aaguid?: string;
-};
-type CaepTokenClaimsChange = CaepCommon & {
-  readonly claims: Readonly<Record<string, unknown>>;
-};
-type CaepAssuranceLevelChange = CaepCommon & {
-  readonly namespace: string;
-  readonly currentLevel: string;
-  readonly previousLevel?: string;
-  readonly changeDirection?: "increase" | "decrease";
-};
-type CaepDeviceComplianceChange = CaepCommon & {
-  readonly previousStatus: "compliant" | "not-compliant";
-  readonly currentStatus: "compliant" | "not-compliant";
-};
-type CaepEvents = {
-  readonly sessionRevoked: (input: CaepCommon) => SetEvent;
-  readonly credentialChange: (input: CaepCredentialChange) => SetEvent;
-  readonly tokenClaimsChange: (input: CaepTokenClaimsChange) => SetEvent;
-  readonly assuranceLevelChange: (input: CaepAssuranceLevelChange) => SetEvent;
-  readonly deviceComplianceChange: (input: CaepDeviceComplianceChange) => SetEvent;
-};
-/** CAEP 1.0 event builders; each returns a `SetEvent` for `signSet`. */
-declare const caepEvents: CaepEvents;
-type RiscAccountDisabled = {
-  readonly subject: SetSubject;
-  readonly reason?: "hijacking" | "bulk-account";
-};
-type RiscCredentialCompromise = CaepCommon & {
-  readonly credentialType: string;
-};
-type RiscEvents = {
-  readonly accountDisabled: (input: RiscAccountDisabled) => SetEvent;
-  readonly accountPurged: (input: {
-    readonly subject: SetSubject;
-  }) => SetEvent;
-  readonly credentialCompromise: (input: RiscCredentialCompromise) => SetEvent;
-};
-/** RISC 1.0 event builders for the events PermDock's receiver treats as revoking every session. */
-declare const riscEvents: RiscEvents;
-/**
- * The SSF 1.0 section 8.1.4 verification event for `stream`, echoing the
- * receiver's `state`. Its subject is the stream, never a principal.
- */
-declare function streamVerificationEvent(stream: string, state?: string): SetEvent;
-//#endregion
-export { setPollHandler as _, CaepTokenClaimsChange as a, RiscEvents as c, caepEvents as d, pushSet as f, memorySetQueue as g, streamVerificationEvent as h, CaepEvents as i, SSF_POLL_DELIVERY as l, signSet as m, CaepCredentialChange as n, RiscAccountDisabled as o, riscEvents as p, CaepDeviceComplianceChange as r, RiscCredentialCompromise as s, CaepAssuranceLevelChange as t, SSF_PUSH_DELIVERY as u, createPermDock as v };

package/dist/index-CueFnxQc.d.ts

@@ -1,110 +0,0 @@
-import { T as Policy, Zt as DeliveryChannel, j as PolicyVocabulary, q as DecisionSink, rr as Principal } from "./policy-types-n0uRTsW8.js";
-import { w as Permission } from "./vocabulary-CN8H_9UF.js";
-import { t as Operation } from "./operations-X0VM7F3m.js";
-import { p as PrincipalSource, r as PermDock } from "./permdock-SV8ZINYT.js";
-import { _ as TransportOptions, a as DeliveryReport, c as DeliveryTransport, g as TransportMessages, i as DeliveryMessages, l as DeliveryTransports, m as Recipient, o as DeliveryResult, r as DeliverOptions, s as DeliveryTarget, y as WebhookTransport } from "./types-BtHtcKMr.js";
-import { l as WebhookSigner } from "./standard-webhooks-rbD7LS6h.js";
-//#region src/delivery/audience.d.ts
-type Audience = {
-  /** Principal ids `decideFor` grants, in discovery or candidate order, each once. */
-  readonly principals: readonly string[];
-  /** `false` when `whoCan` could not list every holder: someone granted may be missing. */
-  readonly complete: boolean;
-};
-type AudienceOptions = {
-  /** Check only these principals instead of listing holders with `whoCan`. */
-  readonly candidates?: readonly string[];
-};
-/**
- * Who may receive a delivery about `row`: the holders `whoCan` lists (or
- * `candidates`), kept only where `decideFor` grants `permission` in the
- * sender's active tenant. A collection permission has no holders to list,
- * so it needs `candidates`; without them it is empty and incomplete.
- */
-declare function audience(permdock: PermDock, permission: Permission, row: unknown, options?: AudienceOptions): Promise<Audience>;
-/** One event a subscriber may receive: the permission its row needs. */
-type SubscriberEvent = {
-  readonly permission: Permission;
-  readonly row?: unknown;
-};
-/**
- * The subscribers whose principal `decideFor` grants the event's
- * permission on its row, in their order: the per-event filter for webhook
- * endpoints and realtime channels. A subscriber without a string
- * `principal` is dropped.
- */
-declare function subscribersFor<S extends {
-  readonly principal: string;
-}>(permdock: PermDock, event: SubscriberEvent, subscribers: readonly S[]): Promise<S[]>;
-//#endregion
-//#region src/delivery/memory-transport.d.ts
-type MemoryDelivery<C extends DeliveryChannel> = {
-  readonly target: DeliveryTarget<C>;
-  readonly message: TransportMessages[C];
-  readonly options: TransportOptions;
-};
-type MemoryDeliveryTransport<C extends DeliveryChannel> = DeliveryTransport<C> & {
-  /** Every delivery `respond` answered `sent` for, oldest first. */
-  readonly deliveries: readonly MemoryDelivery<C>[];
-};
-type MemoryDeliveryTransportOptions<C extends DeliveryChannel> = {
-  /** The result per delivery; defaults to `sent`. A throw propagates, as from a provider client. */
-  readonly respond?: (target: DeliveryTarget<C>, message: TransportMessages[C]) => DeliveryResult;
-};
-/** An in-process transport for tests and examples: it records what it would have sent. */
-declare function memoryDeliveryTransport<C extends DeliveryChannel>(channel: C, options?: MemoryDeliveryTransportOptions<C>): MemoryDeliveryTransport<C>;
-//#endregion
-//#region src/delivery/router.d.ts
-type DeliveryPermDockOptions = {
-  readonly transports: DeliveryTransports;
-  /** Resolves `{ address }` recipients through `principalByIdentity`. */
-  readonly principals?: PrincipalSource;
-  /** Receives one `delivery` event per recipient. A throw is ignored. */
-  readonly sink?: DecisionSink;
-  /** The `from` of an email whose message sets none. */
-  readonly from?: string;
-  /** The event `source`; defaults to `permdock`. */
-  readonly source?: string;
-};
-type DeliveryPermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
-  /**
-   * Checks every recipient against `target`'s permission on `row` with
-   * `permdock.decideFor`, routes the granted ones to the transport of their
-   * channel, and writes one `delivery` event per recipient. Never rejects:
-   * a refused recipient or a transport error is a `failed` event.
-   */
-  readonly deliver: (permdock: PermDock<V>, target: Permission | Pick<Operation, "name" | "permission">, row: unknown, recipients: readonly Recipient[], messages: Partial<DeliveryMessages>, options?: DeliverOptions) => Promise<DeliveryReport>;
-};
-/** Routes checked recipients to channel transports and records a delivery event for each. */
-declare function createPermDock<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(_policy: Policy<TUser, TPrincipal, V>, options: DeliveryPermDockOptions): DeliveryPermDock<V>;
-//#endregion
-//#region src/delivery/target.d.ts
-/**
- * Whether `value` is a target the router checked for `channel`: a non-empty
- * address and a granted decision. A transport calls it first and refuses
- * anything else, so a hand-built recipient never reaches a provider.
- */
-declare function isDeliveryTarget<C extends DeliveryChannel>(value: unknown, channel: C): value is DeliveryTarget<C>;
-/**
- * An RFC 5322 `addr-spec` in dot-atom form with a DNS domain, at most 254
- * characters (RFC 5321 path limit). Quoted local parts, comments and
- * domain literals are refused.
- */
-declare function isAddrSpec(value: string): boolean;
-//#endregion
-//#region src/delivery/webhook-transport.d.ts
-type WebhookTransportOptions = {
-  /** Defaults to the global `fetch`. */
-  readonly fetch?: typeof fetch;
-  /** Milliseconds before a request is aborted as `unavailable`. Defaults to 10000. */
-  readonly timeout?: number;
-};
-/**
- * Posts each CloudEvent to the target's https endpoint as
- * `application/cloudevents+json`, signed with the Standard Webhooks
- * headers. `webhook-id` is the idempotency key, so a retry repeats it and
- * the receiver drops the duplicate. Redirects are not followed.
- */
-declare function webhookTransport(signer: WebhookSigner, options?: WebhookTransportOptions): WebhookTransport;
-//#endregion
-export { DeliveryPermDock as a, MemoryDelivery as c, memoryDeliveryTransport as d, Audience as f, subscribersFor as g, audience as h, isDeliveryTarget as i, MemoryDeliveryTransport as l, SubscriberEvent as m, webhookTransport as n, DeliveryPermDockOptions as o, AudienceOptions as p, isAddrSpec as r, createPermDock as s, WebhookTransportOptions as t, MemoryDeliveryTransportOptions as u };

package/dist/load-BxEtwlBS.js

@@ -1 +0,0 @@
-export { a as loadModule, s as pickNamed } from "./load-DFS_ry0W.js";

package/dist/output-files-B3IZJksC.js

@@ -1 +0,0 @@
-export { t as SPLIT_PARTS } from "./output-files-DhRBBE4n.js";

package/dist/package-root-Dk_ETdkp.js

@@ -1,31 +0,0 @@
-import { i as readJsonFile } from "./files-D_JIzUrP.js";
-import { existsSync } from "node:fs";
-import { dirname, join } from "node:path";
-import { fileURLToPath } from "node:url";
-//#region src/cli/project/package-root.ts
-let cached;
-/**
-* The `permdock` package directory. The bundler may place this module in
-* `dist/cli/` or in a shared chunk at `dist/`, so walk up instead of
-* assuming a depth.
-*/
-function packageRoot() {
-	cached ??= findPackageRoot(dirname(fileURLToPath(import.meta.url)));
-	return cached;
-}
-/** The nearest directory at or above `start` whose `package.json` is named `permdock`. */
-function findPackageRoot(start) {
-	let dir = start;
-	for (;;) {
-		const manifest = join(dir, "package.json");
-		if (existsSync(manifest)) {
-			const { name } = readJsonFile(manifest);
-			if (name === "permdock") return dir;
-		}
-		const parent = dirname(dir);
-		if (parent === dir) throw new Error("PermDock CLI: cannot find the permdock package root");
-		dir = parent;
-	}
-}
-//#endregion
-export { packageRoot as t };

package/dist/parse-Cxq0WxrA.js

@@ -1,53 +0,0 @@
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { n as PermDockValidationError } from "./validation-error-ZfUHbKvf.js";
-import { n as copyJson, t as checkSchema } from "./json-schema-B-vAwlde.js";
-import { t as catalogSchema } from "./schema-B4v0Qrac.js";
-//#region src/catalog/parse.ts
-function invalid(issues) {
-	const [first] = issues;
-	const where = first?.path === void 0 || first.path.length === 0 ? "" : ` at ${first.path.map(String).join(".")}`;
-	const more = issues.length > 1 ? ` (and ${String(issues.length - 1)} more)` : "";
-	throw new PermDockValidationError({
-		code: "invalid-data",
-		permission: "",
-		resource: "",
-		boundary: "catalog",
-		issues,
-		message: `PermDock: invalid catalog${where}: ${first?.message ?? "unknown"}${more}`
-	});
-}
-/**
-* Reads a `permissions.catalog.json` document (parsed, or the JSON text) and
-* validates it against `schemas/catalog-v1.json`. Returns a deep-frozen copy
-* built from own keys; throws `PermDockValidationError` with every issue.
-*/
-function parseCatalog(json) {
-	const issues = [];
-	let input = json;
-	if (typeof json === "string") try {
-		input = JSON.parse(json);
-	} catch (error) {
-		invalid([{
-			message: `Expected JSON text: ${error instanceof Error ? error.message : String(error)}`,
-			path: []
-		}]);
-	}
-	let copy;
-	try {
-		copy = copyJson(input, [], issues, /* @__PURE__ */ new Set());
-	} catch (error) {
-		invalid([{
-			message: `Could not read the input: ${error instanceof Error ? error.message : String(error)}`,
-			path: []
-		}]);
-	}
-	if (issues.length === 0) checkSchema(catalogSchema, copy, [], issues);
-	if (issues.length > 0) invalid(issues);
-	return freezeDeep(copy);
-}
-/** Keys of the permissions the catalog marks `rowConditions: true`: the SQL helpers alone cannot enforce them. */
-function rowConditionKeys(catalog) {
-	return new Set(catalog.permissions.filter((permission) => permission.rowConditions === true).map((permission) => permission.key));
-}
-//#endregion
-export { rowConditionKeys as n, parseCatalog as t };

package/dist/parse-local-manifest-5ODwqu8b.d.ts

@@ -1,10 +0,0 @@
-import { Bt as LocalSnapshotManifest } from "./policy-types-n0uRTsW8.js";
-//#region src/core/parse-local-manifest.d.ts
-/**
- * Whether `value` has the shape `localSnapshotManifest(policy)` writes, with
- * no prototype keys. A JSON import widens `v: 1` to `number`; this narrows it
- * back without a cast.
- */
-declare function parseLocalSnapshotManifest(value: unknown): value is LocalSnapshotManifest;
-//#endregion
-export { parseLocalSnapshotManifest as t };

package/dist/parse-local-manifest-CVSs6J9I.js

@@ -1,34 +0,0 @@
-import { r as isRecord } from "./compact-CAf557ZB.js";
-import { n as isForbiddenKey } from "./paths-DXSHAMIa.js";
-//#region src/core/local-role.ts
-/** The role name custom-role tables in a local snapshot manifest hold their grants under; no declared or tenant role can take it. */
-const LOCAL_CUSTOM_ROLE = "\0custom";
-//#endregion
-//#region src/core/parse-local-manifest.ts
-function isStrings(value) {
-	return Array.isArray(value) && value.every((item) => typeof item === "string");
-}
-function safeKeys(value) {
-	if (Array.isArray(value)) return value.every(safeKeys);
-	if (!isRecord(value)) return true;
-	return Object.entries(value).every(([key, item]) => !isForbiddenKey(key) && safeKeys(item));
-}
-function isGrants(value) {
-	return Array.isArray(value) && value.every((grant) => isRecord(grant) && typeof grant["permission"] === "string" && (grant["effect"] === "allow" || grant["effect"] === "deny") && (grant["role"] === null || typeof grant["role"] === "string") && (isRecord(grant["to"]) || Array.isArray(grant["to"])));
-}
-function isGrantTable(value) {
-	return isRecord(value) && Object.values(value).every(isGrants);
-}
-function isCustomTable(value) {
-	return isRecord(value) && isRecord(value["permissions"]) && Object.values(value["permissions"]).every((row) => isRecord(row) && isGrants(row["all"]) && (row["levels"] === void 0 || isGrantTable(row["levels"]))) && isGrantTable(value["includes"]);
-}
-/**
-* Whether `value` has the shape `localSnapshotManifest(policy)` writes, with
-* no prototype keys. A JSON import widens `v: 1` to `number`; this narrows it
-* back without a cast.
-*/
-function parseLocalSnapshotManifest(value) {
-	return isRecord(value) && value["v"] === 1 && isStrings(value["roles"]) && (value["rank"] === void 0 || isStrings(value["rank"])) && (value["scopes"] === void 0 || Array.isArray(value["scopes"]) && value["scopes"].every(isRecord)) && (value["vocabulary"] === void 0 || isRecord(value["vocabulary"])) && isGrants(value["grants"]) && isRecord(value["custom"]) && Object.values(value["custom"]).every(isCustomTable) && safeKeys(value);
-}
-//#endregion
-export { LOCAL_CUSTOM_ROLE as n, parseLocalSnapshotManifest as t };

package/dist/peer-C8swJ2GH.js

@@ -1,50 +0,0 @@
-import { n as CliError } from "./errors-CWTY6uih.js";
-import { detect, getUserAgent, resolveCommand } from "package-manager-detector";
-//#region src/cli/core/peer.ts
-/**
-* Loads an optional peer dependency for one command, or fails with the line
-* that installs it with the project's package manager. Only the commands that
-* need a peer ever load it.
-*/
-async function requirePeer(load, name, command, cwd = process.cwd()) {
-	try {
-		return await load();
-	} catch (error) {
-		if (!isMissingModule(error)) throw error;
-		const agent = await packageManagerOf(cwd);
-		throw new CliError("unavailable", peerHint(name, command, agent), {
-			cause: error,
-			code: "dependency_missing",
-			extensions: { package: name },
-			next: [{
-				command: addLine(agent, [name], { dev: true }),
-				when: "to install it"
-			}]
-		});
-	}
-}
-/** The package manager whose lockfile the project has, else the one running the CLI. */
-async function packageManagerOf(cwd) {
-	return (await detect({ cwd }))?.agent ?? getUserAgent() ?? void 0;
-}
-/** The command that adds `packages` with `agent`, npm when there is none. */
-function addLine(agent, packages, options) {
-	const args = options?.dev === true ? ["-D", ...packages] : [...packages];
-	const command = resolveCommand(agent ?? "npm", "add", args);
-	return command === null ? `npm install ${args.join(" ")}` : [command.command, ...command.args].join(" ");
-}
-function isMissingModule(error) {
-	if (typeof error !== "object" || error === null || !("code" in error)) return false;
-	return error.code === "ERR_MODULE_NOT_FOUND" || error.code === "MODULE_NOT_FOUND";
-}
-/**
-* The error for a missing peer. `agent` is the package manager that ran the
-* command, or the one whose lockfile the project has; without one the line
-* names pnpm and npm.
-*/
-function peerHint(name, command, agent = getUserAgent() ?? void 0) {
-	const install = agent === void 0 ? void 0 : resolveCommand(agent, "add", ["-D", name]);
-	return `PermDock CLI: ${command} needs the optional peer ${name}. Install it with: ${install === null || install === void 0 ? `pnpm add -D ${name} (or npm install -D ${name})` : [install.command, ...install.args].join(" ")}`;
-}
-//#endregion
-export { requirePeer as i, packageManagerOf as n, peerHint as r, addLine as t };