permdock 0.6.0 → 0.8.0

package/dist/powersync-BkWWCS1K.js

@@ -1,538 +0,0 @@
-import { c as isConditionRef, s as isConditionDate } from "./refs-K6eWUJ0H.js";
-import { E as memoryCustomRoleSource, f as localSnapshotManifest } from "./src-Cu2m75uo.js";
-import { n as findPermission } from "./permission-registry-Br4jSNVi.js";
-import { d as scopeList, o as resolveScope } from "./scopes-CUPSjo9q.js";
-import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
-import { t as getPermDock } from "./permdock-BrAscV28.js";
-import { u as usageResult } from "./errors-CWTY6uih.js";
-import { c as requirePolicy } from "./load-DFS_ry0W.js";
-import { i as scopeMembershipTable, r as scopeColumn } from "./compile-CMqMx_IN.js";
-import { s as quoteSqlLiteral, t as SQL_IDENT } from "./sql-B5T1IL83.js";
-import "./sources-vs5dGOsS.js";
-import { t as applyFiles } from "./files-C5ZI27eV.js";
-import { i as fileDrift } from "./output-files-DhRBBE4n.js";
-import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-B7XrLeY7.js";
-import { N as quoteIdent, a as customRolesOn, t as CUSTOM_ROLES } from "./shared-BAK8t4Uo.js";
-import { f as pgConnector } from "./policies-DP2nqRoF.js";
-import { A as collectGrants, N as contextRefs, t as ownershipRules } from "./ownership-DqaJNJPn.js";
-import { m as tableFor, t as canFixture } from "./verify-BaAKx7t6.js";
-import { resolve } from "node:path";
-//#region src/cli/powersync/streams.ts
-function ident(name) {
-	if (!SQL_IDENT.test(name)) throw new TypeError(`PermDock CLI: '${name}' is not a plain identifier, which Sync Streams need`);
-	return name;
-}
-const POWERSYNC = {
-	user: "auth.user_id()",
-	claim: (name) => `auth.parameter(${quoteSqlLiteral(name)})`,
-	claims: (name) => `(SELECT value FROM json_each(auth.parameter(${quoteSqlLiteral(name)})))`,
-	column: (table, name) => `${table}.${ident(name)}`,
-	literal: (value) => typeof value === "string" ? quoteSqlLiteral(value) : String(value)
-};
-const POSTGRES = {
-	user: "$1::text",
-	claim: (name) => `($2::jsonb ->> ${quoteSqlLiteral(name)})`,
-	claims: (name) => `(select jsonb_array_elements_text(case jsonb_typeof($2::jsonb -> ${quoteSqlLiteral(name)}) when 'array' then $2::jsonb -> ${quoteSqlLiteral(name)} else '[]'::jsonb end))`,
-	column: (table, name, numeric) => `${table}.${ident(name)}${numeric === true ? "" : "::text"}`,
-	literal: (value) => typeof value === "number" ? String(value) : quoteSqlLiteral(String(value))
-};
-/** At most this many queries per stream; a wider `or` product is left out rather than truncated. */
-const MAX_QUERIES = 32;
-/** Every combination of one clause list from each input, ANDed. */
-function product(lists) {
-	let out = [[]];
-	for (const list of lists) out = out.flatMap((left) => list.map((right) => left.concat(right)));
-	return out;
-}
-function every(parts) {
-	const out = [];
-	for (const part of parts) {
-		if (part === void 0) return;
-		out.push(part);
-	}
-	return out;
-}
-/** The table as a stream query names it: unqualified in `public`, `schema.table` otherwise. */
-function bare(table) {
-	return (table.startsWith("public.") ? table.slice(7) : table).split(".").map(ident).join(".");
-}
-/** A row value: a literal, or a principal ref the token carries. `undefined` when neither. */
-function valueSql(value, ctx) {
-	if (isConditionRef(value)) {
-		if (value.ref === "principal.id") return ctx.dialect.user;
-		const claim = /^principal\.claims\.([A-Za-z_][A-Za-z0-9_]*)$/u.exec(value.ref)?.[1];
-		return claim === void 0 ? void 0 : ctx.dialect.claim(claim);
-	}
-	if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") return ctx.dialect.literal(value);
-}
-const COMPARE = {
-	eq: "=",
-	ne: "!=",
-	gt: ">",
-	gte: ">=",
-	lt: "<",
-	lte: "<="
-};
-/**
-* A row condition as alternatives of ANDed clauses over `table`. `undefined`
-* when part of it has no Sync Streams form, so the grant syncs nothing.
-*/
-function conditionSql(condition, table, ctx) {
-	const column = (field) => SQL_IDENT.test(field) ? ctx.dialect.column(table, field) : void 0;
-	switch (condition.op) {
-		case "eq":
-		case "ne":
-		case "gt":
-		case "gte":
-		case "lt":
-		case "lte": {
-			const left = typeof condition.value === "number" && SQL_IDENT.test(condition.field) ? ctx.dialect.column(table, condition.field, true) : column(condition.field);
-			if (condition.value === null && left !== void 0) return condition.op === "eq" ? [[`${left} IS NULL`]] : condition.op === "ne" ? [[`${left} IS NOT NULL`]] : void 0;
-			const right = valueSql(condition.value, ctx);
-			return left === void 0 || right === void 0 ? void 0 : [[`${left} ${COMPARE[condition.op]} ${right}`]];
-		}
-		case "isNull": {
-			const left = column(condition.field);
-			return left === void 0 ? void 0 : [[`${left} IS ${condition.value ? "" : "NOT "}NULL`]];
-		}
-		case "in":
-		case "notIn": {
-			const left = column(condition.field);
-			if (left === void 0) return;
-			const negate = condition.op === "notIn" ? "NOT " : "";
-			if (isConditionRef(condition.value)) {
-				const claim = /^principal\.claims\.([A-Za-z_][A-Za-z0-9_]*)$/u.exec(condition.value.ref)?.[1];
-				return claim === void 0 || negate !== "" ? void 0 : [[`${left} IN ${ctx.dialect.claims(claim)}`]];
-			}
-			const values = condition.value.map((value) => isConditionRef(value) || isConditionDate(value) || Array.isArray(value) ? void 0 : value === null ? void 0 : valueSql(value, ctx));
-			if (values.some((value) => value === void 0)) return;
-			return values.length === 0 ? negate === "" ? [] : [[]] : [[`${left} ${negate}IN (${values.join(", ")})`]];
-		}
-		case "and":
-		case "or": {
-			const parts = every(condition.conditions.map((child) => conditionSql(child, table, ctx)));
-			if (parts === void 0) return;
-			return condition.op === "and" ? product(parts) : parts.flat();
-		}
-		case "memberOf": {
-			if (condition.scope === "resource" || condition.parents !== void 0) return;
-			const scope = resolveScope(ctx.scopes, condition.scope);
-			const left = column(condition.field);
-			if (scope === void 0 || left === void 0) return;
-			return membershipSql(scope, left, condition.roles, ctx);
-		}
-		case "not":
-		case "contains":
-		case "related":
-		case "opaque":
-		case "sqlFunction":
-		case "liveSession": return;
-		default: return condition;
-	}
-}
-/** One `IN (SELECT …)` per role source of the membership table: the row's `left` is an instance the user holds `roles` in. */
-function membershipIn(table, idColumn, left, roles, ctx) {
-	if (table.expiresAt !== void 0 || table.disabledAt !== void 0) return;
-	const name = bare(table.table);
-	const sources = Array.isArray(table.role) ? table.role : [table.role];
-	const kinds = [...new Set(roles.flatMap((role) => ctx.kinds[role] ?? []))];
-	const restricted = roles.some((role) => ctx.kinds[role] !== void 0);
-	if (restricted && (table.via === void 0 || roles.length !== 1)) return;
-	const via = table.via;
-	if (restricted && typeof via === "object" && !kinds.includes(via.value)) return [];
-	const filters = [`${ctx.dialect.column(name, table.user)} = ${ctx.dialect.user}`, ...restricted && typeof via === "string" ? [`${ctx.dialect.column(name, via)} IN (${kinds.map((kind) => ctx.dialect.literal(kind)).join(", ")})`] : []];
-	const list = roles.map((role) => ctx.dialect.literal(role)).join(", ");
-	return sources.map((source) => {
-		if (typeof source === "string") return [`${left} IN (SELECT ${ctx.dialect.column(name, idColumn)} FROM ${name} WHERE ${[...filters, `${ctx.dialect.column(name, source)} IN (${list})`].join(" AND ")})`];
-		const [pair] = Object.entries(source.on);
-		const keys = bare(source.through);
-		const [ref, id] = pair ?? ["", ""];
-		return [`${left} IN (SELECT ${ctx.dialect.column(name, idColumn)} FROM ${name} INNER JOIN ${keys} ON ${ctx.dialect.column(keys, id)} = ${ctx.dialect.column(name, ref)} WHERE ${[...filters, `${ctx.dialect.column(keys, source.column)} IN (${list})`].join(" AND ")})`];
-	});
-}
-function membershipSql(scope, left, roles, ctx) {
-	const table = scopeMembershipTable(ctx.config.rls?.memberships, ctx.scopes, scope);
-	const idColumn = table === void 0 ? void 0 : scopeColumn(table, ctx.scopes, scope);
-	return table === void 0 || idColumn === void 0 ? void 0 : membershipIn(table, idColumn, left, roles, ctx);
-}
-/** Who the grant reaches, as alternatives of clauses; `undefined` when Sync Streams cannot express it. */
-function accessSql(item, table, ctx) {
-	const { access } = item;
-	switch (access.kind) {
-		case "anyone":
-		case "authenticated": return [[]];
-		case "role": {
-			if (access.scope === "global") return `global role ${access.role} is not a row filter`;
-			const field = ctx.policy.scopes.find((scope) => scope.name === access.scope)?.key;
-			if (field === void 0 || !SQL_IDENT.test(field)) return `scope ${access.scope} has no row key`;
-			return membershipSql(access.scope, ctx.dialect.column(table, field), [access.role], ctx) ?? `no rls.memberships table without an expiry or disabledAt and with the kinds of ${access.role} for scope ${access.scope}`;
-		}
-		case "resource": {
-			const holder = ctx.config.rls?.memberships?.resource?.[access.resource];
-			const node = ctx.policy.resources.get(item.grant.permission.resource);
-			const field = node?.name === access.resource ? node.id : node?.parent?.resource === access.resource ? node.parent.field : void 0;
-			if (holder === void 0 || field === void 0 || !SQL_IDENT.test(field)) return `no rls.memberships.resource table for ${access.resource} on the row`;
-			return membershipIn(holder, holder.id ?? "id", ctx.dialect.column(table, field), [access.role], ctx) ?? `the ${access.resource} memberships table has an expiry or disabledAt, or lacks via`;
-		}
-		case "actor": return "actor grantees are not in the sync token";
-		default: return access;
-	}
-}
-/** `permdock_<table>`, with a schema joined by `_`; a table in the `permdock` schema keeps one prefix. */
-function subjectStreamName(table) {
-	const name = table.replaceAll(".", "_");
-	return name.startsWith("permdock_") ? name : `permdock_${name}`;
-}
-function roleThroughs(role) {
-	return (Array.isArray(role) ? role : [role]).filter((item) => typeof item === "object" && item !== null);
-}
-/**
-* Streams of the rows a device builds the user's snapshot from: the user's
-* own membership and global-role rows, the roles tables they reference, and
-* the custom roles of the user's tenants. Each query starts from the user's
-* own rows.
-*/
-function subjectStreams(ctx) {
-	const rls = ctx.config.rls;
-	const { dialect } = ctx;
-	const tables = /* @__PURE__ */ new Map();
-	const add = (table, query, user) => {
-		const entry = tables.get(table) ?? {
-			user: void 0,
-			queries: /* @__PURE__ */ new Set()
-		};
-		if (entry.queries.size === 0) entry.user = user;
-		else if (entry.user !== user) entry.user = void 0;
-		entry.queries.add(query);
-		tables.set(table, entry);
-	};
-	const own = (table, user, role) => {
-		const name = bare(table);
-		const mine = `${dialect.column(name, user)} = ${dialect.user}`;
-		add(name, `SELECT * FROM ${name} WHERE ${mine}`, user);
-		for (const through of roleThroughs(role)) {
-			const keys = bare(through.through);
-			const [pair] = Object.entries(through.on);
-			if (pair === void 0) continue;
-			const [ref, id] = pair;
-			add(keys, `SELECT * FROM ${keys} WHERE ${dialect.column(keys, id)} IN (SELECT ${dialect.column(name, ref)} FROM ${name} WHERE ${mine})`);
-		}
-	};
-	const memberships = rls?.memberships;
-	for (const table of [
-		...Object.values(memberships?.scopes ?? {}),
-		...memberships?.tenant === void 0 ? [] : [memberships.tenant],
-		...memberships?.team === void 0 ? [] : [memberships.team],
-		...Object.values(memberships?.resource ?? {})
-	]) own(table.table, table.user, table.role);
-	const schema = rls?.schema ?? "permdock";
-	const database = rls?.authorize === "database";
-	const globalRoles = rls?.roles ?? (database ? { table: `${schema}.user_roles` } : void 0);
-	if (globalRoles !== void 0) own(globalRoles.table, globalRoles.user ?? "user_id", globalRoles.role ?? "role");
-	if (database && customRolesOn(rls)) {
-		const root = ctx.scopes[0]?.name;
-		const tenants = root === void 0 ? void 0 : scopeMembershipTable(memberships, ctx.scopes, root);
-		const column = tenants === void 0 || root === void 0 ? void 0 : scopeColumn(tenants, ctx.scopes, root);
-		for (const name of [CUSTOM_ROLES.permissions, CUSTOM_ROLES.includes]) {
-			const table = bare(`${schema}.${name}`);
-			const tenant = dialect.column(table, "tenant_id");
-			add(table, `SELECT * FROM ${table} WHERE ${tenant} IS NULL`);
-			if (tenants !== void 0 && column !== void 0) {
-				const members = bare(tenants.table);
-				add(table, `SELECT * FROM ${table} WHERE ${tenant} IN (SELECT ${dialect.column(members, column)} FROM ${members} WHERE ${dialect.column(members, tenants.user)} = ${dialect.user})`);
-			}
-		}
-	}
-	const out = [];
-	for (const [table, entry] of tables) {
-		const name = subjectStreamName(table);
-		const queries = [...entry.queries];
-		out.push(entry.user === void 0 ? {
-			name,
-			table,
-			queries
-		} : {
-			name,
-			table,
-			user: entry.user,
-			queries
-		});
-	}
-	return out;
-}
-/** Why a grant cannot become a stream query, before its conditions are compiled. */
-function unsupported(item) {
-	const { grant } = item;
-	if (grant.breakGlass !== void 0) return "break-glass";
-	if (grant.closure !== void 0 || grant.portable === false) return "not portable";
-	if (requiresApproval(grant.approval)) return "needs approval";
-	if (grant.validity !== void 0) return "time-bounded";
-	const context = contextRefs(item.where);
-	return context.length > 0 ? `reads ${context.join(", ")}` : void 0;
-}
-/**
-* Sync Streams for each synced resource: the union of the rows its read
-* permission's allow grants reach. A grant with any part Sync Streams cannot
-* express syncs nothing, and a resource with a deny grant gets no stream, so
-* a stream never holds a row the policy denies.
-*/
-function powersyncPlan(policy, config, dialect = POWERSYNC) {
-	const scopes = scopeList(policy.scopes);
-	const ctx = {
-		policy,
-		config,
-		scopes,
-		kinds: ownershipRules(policy, scopes)?.kinds ?? {},
-		dialect
-	};
-	const action = config.powersync?.action ?? "read";
-	const grants = collectGrants(policy);
-	const resources = config.powersync?.resources ?? [...policy.resources.keys()].filter((name) => grants.some((item) => item.grant.permission.resource === name && item.grant.permission.action === action));
-	const streams = [];
-	const omitted = [];
-	const warnings = [];
-	for (const resource of resources) {
-		const node = policy.resources.get(resource);
-		const key = `${resource}.${action}`;
-		const items = grants.filter((item) => item.grant.permission.key === key);
-		if (node === void 0 || items.length === 0) {
-			omitted.push({
-				resource,
-				reason: `no grant of ${key}`
-			});
-			continue;
-		}
-		if (items.some((item) => item.grant.effect === "deny")) {
-			omitted.push({
-				resource,
-				reason: `${key} has a deny grant, which Sync Streams cannot subtract`
-			});
-			continue;
-		}
-		const table = bare(tableFor(resource, config.rls?.tables));
-		const { id } = node;
-		const queries = /* @__PURE__ */ new Set();
-		for (const item of items) {
-			const label = `${item.label}/${key}`;
-			const access = unsupported(item) ?? accessSql(item, table, ctx);
-			if (typeof access === "string") {
-				warnings.push(`${label} does not sync: ${access}`);
-				continue;
-			}
-			const where = item.where === void 0 ? [[]] : conditionSql(item.where, table, ctx);
-			if (where === void 0) {
-				warnings.push(`${label} does not sync: its condition has no Sync Streams form`);
-				continue;
-			}
-			const columns = item.grant.fields === void 0 ? "*" : [.../* @__PURE__ */ new Set([id, ...item.grant.fields])].map((field) => ctx.dialect.column(table, field)).join(", ");
-			for (const clauses of product([access, where])) queries.add(`SELECT ${columns} FROM ${table}${clauses.length === 0 ? "" : ` WHERE ${clauses.join(" AND ")}`}`);
-		}
-		if (queries.size === 0) omitted.push({
-			resource,
-			reason: `no grant of ${key} compiles`
-		});
-		else if (queries.size > MAX_QUERIES) omitted.push({
-			resource,
-			reason: `${String(queries.size)} queries, over the limit of ${String(MAX_QUERIES)}`
-		});
-		else streams.push({
-			name: resource,
-			resource,
-			table,
-			id,
-			queries: [...queries]
-		});
-	}
-	return {
-		streams,
-		subject: subjectStreams(ctx),
-		omitted,
-		warnings
-	};
-}
-/** `sync-config.yaml`: edition 3 Sync Streams, one auto-subscribed stream per synced resource. */
-function powersyncYaml(plan) {
-	const lines = [
-		"# Generated by permdock powersync generate from the policy. Do not edit.",
-		"config:",
-		"  edition: 3",
-		"",
-		"streams:"
-	];
-	if (plan.streams.length === 0 && plan.subject.length === 0) lines[lines.length - 1] = "streams: {}";
-	for (const stream of [...plan.streams, ...plan.subject]) lines.push(`  ${stream.name}:`, "    auto_subscribe: true", "    queries:", ...stream.queries.map((query) => `      - ${JSON.stringify(query)}`));
-	for (const item of plan.omitted) lines.push(`# ${item.resource}: not synced, ${item.reason}`);
-	return `${lines.join("\n")}\n`;
-}
-//#endregion
-//#region src/cli/powersync/powersync.ts
-const POWERSYNC_HELP = `permdock powersync generate [--out sync-config.yaml] [--check]
-permdock powersync verify [--db-url-stdin] [--fixtures rls.fixtures.json]`;
-const DEFAULT_OUT = "sync-config.yaml";
-function powersyncOut(config, out) {
-	return out ?? config.powersync?.out ?? DEFAULT_OUT;
-}
-function loadPolicy(cwd, config, from) {
-	return requirePolicy(cwd, from ?? config.policy, "powersync needs policy in the config or --policy");
-}
-function sameJson(current, expected) {
-	try {
-		return JSON.stringify(JSON.parse(current)) === JSON.stringify(JSON.parse(expected));
-	} catch {
-		return false;
-	}
-}
-/**
-* The files the policy compiles to: the Sync Streams file and, with
-* `powersync.manifest`, the local-snapshot manifest. `warnings` lists the
-* grants that do not sync.
-*/
-function powersyncFiles(policy, config, out) {
-	const plan = powersyncPlan(policy, config);
-	const files = [{
-		path: powersyncOut(config, out),
-		text: powersyncYaml(plan)
-	}];
-	const manifest = config.powersync?.manifest;
-	if (manifest !== void 0) files.push({
-		path: manifest,
-		json: true,
-		text: `${JSON.stringify(localSnapshotManifest(policy), null, 2)}\n`
-	});
-	return {
-		files,
-		warnings: plan.warnings
-	};
-}
-/** The files whose content on disk is not what the policy compiles to, with `missing` for an absent one. */
-function staleFiles(cwd, files) {
-	const stale = [];
-	for (const file of files) {
-		const found = fileDrift(resolve(cwd, file.path), file.text, file.json === true ? sameJson : void 0);
-		if (found !== void 0) stale.push({
-			path: file.path,
-			missing: found.kind === "missing"
-		});
-	}
-	return stale;
-}
-function rowValue(row, key) {
-	const value = key !== void 0 && row !== null && typeof row === "object" && !Array.isArray(row) ? Object.entries(row).find(([name]) => name === key)?.[1] : void 0;
-	return value === void 0 || value === null ? void 0 : String(value);
-}
-function claimsJson(fixture) {
-	return JSON.stringify(fixture.subject.claims ?? {});
-}
-/** Whether a stream of the user's own rows holds a row of another user. */
-async function leaks(query, stream, user, fixture) {
-	for (const text of stream.queries) if ((await query(`select 1 from (${text}) q where q.${quoteIdent(user)}::text is distinct from $1::text and $2::jsonb is not null limit 1`, [fixture.subject.id, claimsJson(fixture)])).length > 0) return true;
-	return false;
-}
-/** Whether the stream holds the fixture's row for its subject. */
-async function synced(query, stream, fixture) {
-	const value = rowValue(fixture.row, stream.id);
-	if (value === void 0) return false;
-	for (const text of stream.queries) if ((await query(`select 1 from (${text}) q where q.${quoteIdent(stream.id)}::text = $3::text and $1::text is not null and $2::jsonb is not null limit 1`, [
-		fixture.subject.id,
-		claimsJson(fixture),
-		value
-	])).length > 0) return true;
-	return false;
-}
-async function verifyStreams(input) {
-	const plan = powersyncPlan(input.policy, input.config, POSTGRES);
-	const mismatches = [];
-	const notes = [];
-	const client = await input.connect(input.db);
-	const query = async (sql, values) => (await client.query(sql, values)).rows;
-	const root = input.policy.scopes.find((scope) => scope.within === void 0)?.key;
-	try {
-		const checked = /* @__PURE__ */ new Set();
-		for (const fixture of input.fixtures) {
-			if (checked.has(fixture.subject.id)) continue;
-			checked.add(fixture.subject.id);
-			for (const stream of plan.subject) if (stream.user !== void 0 && await leaks(query, stream, stream.user, fixture)) mismatches.push(`stream ${stream.name} syncs another user's ${stream.table} rows to ${fixture.subject.id}`);
-		}
-		for (const fixture of input.fixtures) {
-			const permission = findPermission(input.policy.permissions, fixture.action);
-			const stream = plan.streams.find((item) => permission !== void 0 && item.resource === permission.resource && permission.action === (input.config.powersync?.action ?? "read"));
-			if (permission === void 0 || stream === void 0) continue;
-			const tenant = rowValue(fixture.row, root);
-			const permdock = await getPermDock(input.policy, fixtureSubject({
-				...fixture.subject,
-				...tenant === void 0 ? {} : { tenant }
-			}), { customRoles: memoryCustomRoleSource(input.customRoles) });
-			const granted = canFixture(permdock, permission, fixtureRow(fixture, permission.kind));
-			const holds = await synced(query, stream, fixture);
-			if (holds && !granted) mismatches.push(`${fixture.action} for ${fixture.subject.id}: stream ${stream.name} syncs a row the policy denies`);
-			else if (granted && !holds) notes.push(`${fixture.action} for ${fixture.subject.id}: granted, not synced (the app reads it from the server)`);
-		}
-	} finally {
-		await client.end();
-	}
-	return {
-		mismatches,
-		notes
-	};
-}
-async function runPowerSync(input) {
-	const [verb] = input.rest;
-	if (verb !== "generate" && verb !== "verify") return {
-		code: 2,
-		output: POWERSYNC_HELP
-	};
-	let policy;
-	let compiled;
-	try {
-		policy = await loadPolicy(input.cwd, input.config, input.from);
-		compiled = powersyncFiles(policy, input.config, input.out);
-	} catch (cause) {
-		return usageResult(cause);
-	}
-	const { files, warnings } = compiled;
-	const out = powersyncOut(input.config, input.out);
-	const stale = staleFiles(input.cwd, files);
-	if (verb === "generate") {
-		if (input.check) return stale.length === 0 ? {
-			code: 0,
-			output: files.map((file) => `${file.path} is current`).join("\n")
-		} : {
-			code: 1,
-			output: stale.map((file) => `${file.path} is stale: run permdock powersync generate`).join("\n")
-		};
-		applyFiles(input.cwd, files);
-		return {
-			code: 0,
-			output: [...files.map((file) => `wrote ${file.path}`), ...warnings].join("\n")
-		};
-	}
-	const mismatches = stale.map((file) => `${file.path} ${file.missing ? "is missing" : "differs from the policy"}: run permdock powersync generate`);
-	const notes = [...warnings];
-	if (input.db !== void 0) try {
-		const fixturesPath = input.fixtures ?? input.config.rls?.fixtures ?? "rls.fixtures.json";
-		const { fixtures, customRoles } = await loadFixtures(input.cwd, fixturesPath);
-		const database = await verifyStreams({
-			policy,
-			config: input.config,
-			fixtures,
-			customRoles,
-			db: input.db,
-			connect: input.connect ?? pgConnector("permdock powersync verify --db-url-stdin", input.cwd)
-		});
-		mismatches.push(...database.mismatches);
-		notes.push(...database.notes);
-	} catch (cause) {
-		return usageResult(cause);
-	}
-	if (mismatches.length > 0) return {
-		code: 1,
-		output: [...mismatches, ...notes].join("\n")
-	};
-	const verified = input.db === void 0 ? `${out} matches the policy` : `${out} matches the policy; no stream syncs a row the fixtures deny`;
-	return {
-		code: 0,
-		output: notes.length === 0 ? verified : `${verified}\n${notes.join("\n")}`
-	};
-}
-//#endregion
-export { runPowerSync as n, staleFiles as r, powersyncFiles as t };

package/dist/powersync-MMJ2mI2q.js

@@ -1 +0,0 @@
-export { n as runPowerSync } from "./powersync-BkWWCS1K.js";

package/dist/problem-details-B45V5d2b.d.ts

@@ -1,7 +0,0 @@
-import { Nn as Decision } from "./policy-types-n0uRTsW8.js";
-//#region src/core/problem-details.d.ts
-type Disclosure = "hide" | "reveal";
-/** The plans a `not-entitled` denial asks for; empty unless every denial is `not-entitled`. */
-declare function requiredPlans(decision: Decision): readonly string[];
-//#endregion
-export { requiredPlans as n, Disclosure as t };

package/dist/prompt-DfZLJLIn.js

@@ -1,32 +0,0 @@
-import { cancel, confirm, isCancel, multiselect } from "@clack/prompts";
-//#region src/cli/core/prompt.ts
-/** What a command reports when the person at the terminal cancels a prompt. */
-const CANCELLED = {
-	code: 130,
-	output: "Cancelled."
-};
-/** A yes or no question; `undefined` when cancelled. */
-async function ask(message) {
-	const answer = await confirm({ message });
-	if (isCancel(answer)) {
-		cancel();
-		return;
-	}
-	return answer;
-}
-/** Pick one or more of `options`, `initial` preselected; `undefined` when cancelled. */
-async function pick(message, options, initial) {
-	const answer = await multiselect({
-		message,
-		options: options.map((option) => ({ ...option })),
-		initialValues: [...initial],
-		required: true
-	});
-	if (isCancel(answer)) {
-		cancel();
-		return;
-	}
-	return answer;
-}
-//#endregion
-export { ask as n, pick as r, CANCELLED as t };

package/dist/protected-RFGpakN9.d.ts

@@ -1,38 +0,0 @@
-import { Nn as Decision, j as PolicyVocabulary, nr as Membership } from "./policy-types-n0uRTsW8.js";
-import { r as Role, w as Permission } from "./vocabulary-CN8H_9UF.js";
-import { r as DescribeOptions, t as DecisionDescription } from "./describe-B5qgDvEW.js";
-import { a as FilterResult, c as PermissionSet, d as RolesOptions, f as SubjectView, l as PermissionState, o as GateMode, p as TenantView, r as ClientPermDock, s as GateView, t as ApprovalHandle } from "./types-B3_ooZgZ.js";
-import { r as ProtectedProps } from "./types-CX7AvRqP.js";
-import { ReactNode } from "react";
-//#region src/react/hooks.d.ts
-declare function usePermDock<V extends PolicyVocabulary = PolicyVocabulary>(): ClientPermDock<V>;
-declare function usePermission(permission: Permission, data?: unknown): PermissionState;
-declare function usePermissions(permissions: readonly Permission[], data?: unknown): PermissionSet;
-declare function useFilter<T>(permission: Permission<string, T, "instance">, rows: readonly T[]): FilterResult<T>;
-declare function useTenant(): TenantView;
-declare function useMemberships(): readonly Membership[];
-declare function useRoles(options?: RolesOptions): {
-  readonly roles: readonly Role[];
-};
-declare function useAssignableRoles(): readonly Role[];
-declare function useAssignablePermissions(options?: {
-  readonly tenant?: string;
-}): readonly Permission[];
-declare function useSubject(): SubjectView;
-/** `describe` with the provider's `messages`; a call's own `messages` win. */
-declare function useDescribe(): (decision: Decision, options?: DescribeOptions) => DecisionDescription;
-declare function useApproval(decision: Decision): ApprovalHandle;
-/**
- * What a permission-gated control renders: `hidden`, `disabled`,
- * `needsApproval`, `upgrade` and a localised `reason`, from the same
- * snapshot as `usePermission`. React and React Native share it; a recipe
- * renders the fields and decides nothing.
- */
-declare function useGate(permission: Permission, data?: unknown, options?: {
-  readonly mode?: GateMode;
-}): GateView;
-//#endregion
-//#region src/react/protected.d.ts
-declare function Protected(props: ProtectedProps): ReactNode;
-//#endregion
-export { useDescribe as a, useMemberships as c, usePermissions as d, useRoles as f, useAssignableRoles as i, usePermDock as l, useTenant as m, useApproval as n, useFilter as o, useSubject as p, useAssignablePermissions as r, useGate as s, Protected as t, usePermission as u };

package/dist/pull-CvpINcMK.js

@@ -1 +0,0 @@
-export { n as runCloudPull } from "./pull-jEwbf80J.js";

package/dist/run-DDwUaJDU.js

@@ -1 +0,0 @@
-export { t as run } from "./run-CUKuz0A8.js";