permdock 0.6.0 → 0.8.0

package/dist/sources-Xc4zkszI.d.ts

@@ -1,190 +0,0 @@
-import { et as MembershipSource } from "./policy-types-n0uRTsW8.js";
-import { n as RoleThrough, y as SupabaseSuspension } from "./types-BzzaHxt3.js";
-import { o as SupabaseManifestMembership } from "./manifest-mx5ghSFM.js";
-//#region src/supabase/roles.d.ts
-/** A roles table a role column references, by `schema.table`. */
-type RoleKeys = {
-  readonly table: string;
-  /** The roles table column the reference points at. */
-  readonly id: string;
-  /** The roles table column holding the role key. */
-  readonly key: string;
-  /** The referencing table's column. */
-  readonly ref: string;
-};
-//#endregion
-//#region src/supabase/sources.d.ts
-/**
- * Runs one parameterised statement: `pg`'s `client.query` (which resolves
- * `{ rows }`) and `postgres`'s `sql.unsafe` (which resolves the rows) both fit.
- */
-type SqlQuery = (text: string, values: readonly unknown[]) => Promise<readonly Record<string, unknown>[] | {
-  readonly rows: readonly Record<string, unknown>[];
-}>;
-type Common = {
-  readonly table: string;
-  /** Runs the lookups; without it the source only describes SQL (for `permdock supabase hook generate`). */
-  readonly query?: SqlQuery;
-  /** Drop suspended users and memberships under suspended instances, like `rls.suspension`. */
-  readonly suspension?: SupabaseSuspension;
-};
-type MembershipTableOptions = Common & {
-  /** Column names; `user`, `scope`, `id` and `role` default to `user_id`, `scope`, `scope_id`, `role`. */
-  readonly columns?: {
-    /** The user id column, or a reference to a table that holds the user id. */
-    readonly user?: string | RoleThrough;
-    readonly scope?: string;
-    readonly id?: string;
-    /** A `jsonb` column of ancestor ids keyed by scope name. */
-    readonly within?: string;
-    /**
-     * The role key column, a reference to a roles table that holds the key,
-     * or several of them: the row holds every non-null key.
-     */
-    readonly role?: string | RoleThrough | readonly (string | RoleThrough)[];
-    readonly via?: string;
-    readonly expiresAt?: string;
-    readonly disabledAt?: string;
-    /** The principal id that wrote the membership (`grantedBy`). */
-    readonly grantedBy?: string;
-    /** Free-text justification recorded on the membership (`reason`). */
-    readonly reason?: string;
-    /** A subgroup column filling `member.group`. */
-    readonly group?: string;
-    /** A text column; the value `idp` marks the row as owned by the identity provider. */
-    readonly managedBy?: string;
-    /** A `text[]` column of seats. */
-    readonly seats?: string;
-    /** A `jsonb` column of app data (`Membership.x`); never written into claims. */
-    readonly x?: string;
-  };
-};
-type MembershipJunctionOptions = Common & {
-  /** The declared scope every row is a membership of. */
-  readonly scope: string;
-  /** The user id column (default `user_id`), or a reference to a table that holds the user id. */
-  readonly user?: string | RoleThrough;
-  /** The column holding the scope instance id. Default `<scope>_id`. */
-  readonly id?: string;
-  /** Ancestor id columns keyed by scope name. */
-  readonly within?: Readonly<Record<string, string>>;
-  /**
-   * A role column, a reference to a roles table that holds the key, fixed
-   * roles every row holds (a contact table with no role column), or
-   * `{ sources }`: several role columns whose non-null keys the row holds.
-   */
-  readonly roles: string | RoleThrough | readonly string[] | {
-    readonly sources: readonly (string | RoleThrough)[];
-  };
-  /** The membership kind every row has (`contact`, `staff`, `partner`). */
-  readonly via?: string;
-  readonly expiresAt?: string;
-  readonly disabledAt?: string;
-  /** The principal id that wrote the membership (`grantedBy`). */
-  readonly grantedBy?: string;
-  /** Free-text justification recorded on the membership (`reason`). */
-  readonly reason?: string;
-  /** A subgroup filling `member.group`: a fixed name every row has, or a column. */
-  readonly group?: string | {
-    readonly column: string;
-  };
-  /** `idp` when the identity provider owns every row, or a text column holding `idp` per row. */
-  readonly managedBy?: "idp" | {
-    readonly column: string;
-  };
-  /** A `text[]` column of seats. */
-  readonly seats?: string;
-  /** A `jsonb` column of app data (`Membership.x`); never written into claims. */
-  readonly x?: string;
-};
-/** What `permdock supabase hook generate` compiles; the same SQL the source runs. */
-type MembershipSql = {
-  readonly table: string;
-  /** The table's user column: the user id, or with `userThrough` the reference to the row holding it. */
-  readonly user: string;
-  /** The table that holds the user id when `user` references it; a change of that id bumps the old and the new user. */
-  readonly userThrough?: RoleKeys;
-  /** `<table>.<user>%type`: the PL/pgSQL type of the user id column, for a variable `select` compares with. */
-  readonly userType: string;
-  /**
-   * The `select` of claim rows for one user, with every filter applied.
-   * `user` must have the column's type (a `userType` variable, or an untyped
-   * `$1` Postgres infers): the column is compared uncast so its index applies.
-   * `keep` adds the `keep` column; it defaults to `keeps`, and a `union`
-   * with a source that keeps passes `true`.
-   */
-  select(user: string, keep?: boolean): string;
-  /** The `select` of member rows for one scope instance (`$1` scope, `$2` id). */
-  list(keep?: boolean): string;
-  /** A suspended scope on the source keeps permissions: rows of its suspended instances stay, with a `keep` column. */
-  readonly keeps: boolean;
-  /** A text column holding `idp` for rows the identity provider owns; `''` when every row is owned. */
-  readonly managed?: string;
-  /** Other tables the `select` reads (suspension tables). */
-  readonly reads: readonly string[];
-  /** The roles table the role column references; a key change bumps every holder's authorization version. */
-  readonly through?: RoleKeys;
-  /** Every roles table the role columns reference, `through` first. */
-  readonly throughs: readonly RoleKeys[];
-  /** Every column that decides who holds which membership: user, scope, id, `within`, role, `via` and expiry. */
-  readonly columns: readonly string[];
-  /** For a single-scope source: its scope and the scopes whose ids each row carries. */
-  readonly scope?: string;
-  readonly holds?: readonly string[];
-  /** The source's entry in the hook manifest's `memberships`. */
-  readonly manifest: SupabaseManifestMembership;
-  /** What the ownership triggers count; absent on a source that is not a table. */
-  readonly holders?: MembershipHolders;
-};
-/**
- * The rows of a membership table, for the holder-count and transfer-only
- * triggers `permdock rls generate` puts on it. No suspension filter: a
- * suspended holder still holds the role.
- */
-type MembershipHolders = {
-  /** `<table>.<id column>%type`: the type of a variable `rows` compares the id column with. */
-  readonly idType: string;
-  /** The instance id of scope `scope` the PL/pgSQL record `row` holds, as text; null on a row of another scope. */
-  id(scope: string, row: string): string;
-  /**
-   * `select id, user_id, role, via, live` over the rows of scope `scope`
-   * in `from` (default the table): one row per held role key, `live` false
-   * once expired. `id` is an expression of `idType` the id column must equal.
-   */
-  rows(scope: string, options?: {
-    readonly id?: string;
-    readonly from?: string;
-  }): string;
-};
-type SqlMembershipSource = MembershipSource & {
-  readonly sql: MembershipSql;
-};
-/** The part of `@supabase/server`'s `PostgresApi` a `SqlQuery` needs. */
-type SupabasePostgres = {
-  readonly queryRaw: (text: string, params?: unknown[]) => Promise<readonly Record<string, unknown>[]>;
-};
-declare function supabasePostgresQuery(postgres: SupabasePostgres): SqlQuery;
-/**
- * Memberships from one table holding every scope: a row per user, scope,
- * instance and role (`user_id, scope, scope_id, role`), with optional
- * `within`, `via`, expiry, owner and seat columns. Rows of the same instance
- * merge into one membership.
- */
-declare function tableMembershipSource(options: MembershipTableOptions): SqlMembershipSource;
-/**
- * Memberships from a table of one scope (`customer_contacts`): every row is a
- * membership of `scope`, with roles from a column or fixed (`['contact']`), a
- * fixed `via`, and ancestor ids from `within` columns.
- */
-declare function junctionMembershipSource(options: MembershipJunctionOptions): SqlMembershipSource;
-declare const AUTHZ_VERSION_TABLE = "permdock_authz_version";
-/**
- * Reads the authorization version `permdock supabase hook generate` keeps in
- * `<schema>.permdock_authz_version`: pass it to `claimsFirst(sources, { version })`.
- */
-declare function authzVersion(options: {
-  readonly query: SqlQuery;
-  readonly schema?: string;
-}): NonNullable<MembershipSource["version"]>;
-//#endregion
-export { MembershipTableOptions as a, SupabasePostgres as c, supabasePostgresQuery as d, tableMembershipSource as f, MembershipSql as i, authzVersion as l, MembershipHolders as n, SqlMembershipSource as o, MembershipJunctionOptions as r, SqlQuery as s, AUTHZ_VERSION_TABLE as t, junctionMembershipSource as u };

package/dist/stores-BUGNbJTt.d.ts

@@ -1,30 +0,0 @@
-import { Nn as Decision, nr as Membership } from "./policy-types-n0uRTsW8.js";
-import { r as Role, w as Permission } from "./vocabulary-CN8H_9UF.js";
-import { r as DescribeOptions, t as DecisionDescription } from "./describe-B5qgDvEW.js";
-import { a as FilterResult, c as PermissionSet, d as RolesOptions, f as SubjectView, l as PermissionState, p as TenantView, r as ClientPermDock, t as ApprovalHandle } from "./types-B3_ooZgZ.js";
-import { n as SveltePermDockOptions } from "./types-CVZSNocA.js";
-import { Readable } from "svelte/store";
-//#region src/svelte/stores.d.ts
-declare function setPermDock(options: SveltePermDockOptions): ClientPermDock;
-declare function getPermDock(): ClientPermDock;
-/** `describe` with the provider's `messages`; a call's own `messages` win. Call it during component init. */
-declare function getDescribe(): (decision: Decision, options?: DescribeOptions) => DecisionDescription;
-declare function permission(reference: Permission, data?: () => unknown): Readable<PermissionState>;
-declare function permissions(references: () => readonly Permission[], data?: () => unknown): Readable<PermissionSet>;
-declare function filtered<T>(reference: Permission<string, T, "instance">, rows: () => readonly T[]): Readable<FilterResult<T>>;
-declare function tenant(): Readable<TenantView>;
-declare function memberships(): Readable<readonly Membership[]>;
-declare function roles(options?: () => RolesOptions): Readable<{
-  readonly roles: readonly Role[];
-}>;
-declare function assignable(): Readable<readonly Role[]>;
-type AssignableOptions = {
-  readonly tenant?: string;
-} | (() => {
-  readonly tenant?: string;
-});
-declare function assignablePermissions(options?: AssignableOptions): Readable<readonly Permission[]>;
-declare function subject(): Readable<SubjectView>;
-declare function approval(decision: () => Decision): Readable<ApprovalHandle>;
-//#endregion
-export { getDescribe as a, permission as c, setPermDock as d, subject as f, filtered as i, permissions as l, assignable as n, getPermDock as o, tenant as p, assignablePermissions as r, memberships as s, approval as t, roles as u };

package/dist/supabase-hook-CCw5m35C.js

@@ -1 +0,0 @@
-export { i as runSupabase } from "./supabase-hook-BMoEhZir.js";

package/dist/supautils-B6HYL9eL.js

@@ -1,91 +0,0 @@
-import { i as group, o as sqlStatements } from "./deciding-columns-Sq12mEA6.js";
-//#region src/cli/sql/supautils.ts
-/** `supautils.reserved_roles` of supabase/postgres 17.11.0.002 (supautils 3.4.4). */
-const RESERVED_ROLES = /* @__PURE__ */ new Set([
-	"supabase_admin",
-	"supabase_auth_admin",
-	"supabase_storage_admin",
-	"supabase_read_only_user",
-	"supabase_realtime_admin",
-	"supabase_replication_admin",
-	"supabase_etl_admin",
-	"supabase_privileged_role",
-	"dashboard_user",
-	"pgbouncer",
-	"service_role",
-	"authenticator",
-	"authenticated",
-	"anon"
-]);
-/** The `*` entries of `reserved_roles`: `postgres` may still `set` or `reset` their settings. */
-const CONFIGURABLE_ROLES = /* @__PURE__ */ new Set([
-	"service_role",
-	"authenticator",
-	"authenticated",
-	"anon"
-]);
-/** `supautils.reserved_memberships` of the same image. */
-const RESERVED_MEMBERSHIPS = /* @__PURE__ */ new Set([
-	"pg_read_server_files",
-	"pg_write_server_files",
-	"pg_execute_server_program",
-	"supabase_admin",
-	"supabase_auth_admin",
-	"supabase_storage_admin",
-	"supabase_read_only_user",
-	"supabase_realtime_admin",
-	"supabase_replication_admin",
-	"supabase_etl_admin",
-	"dashboard_user",
-	"pgbouncer",
-	"authenticator"
-]);
-const ROLE = String.raw`(?:"[^"]+"|\w+)`;
-const ROLES = String.raw`${ROLE}(?:\s*,\s*${ROLE})*`;
-const ALTER_ROLE = new RegExp(String.raw`^alter\s+(role|user|group)\s+(${ROLE})\s+([\s\S]*)$`, "iu");
-const DROP_ROLE = new RegExp(String.raw`^drop\s+(?:role|user|group)\s+(?:if\s+exists\s+)?(${ROLES})\s*$`, "iu");
-const GRANT_ROLE = /^grant\s+([\s\S]+?)\s+to\s/iu;
-const CREATE_IN_ROLE = new RegExp(String.raw`^create\s+(?:role|user|group)\s+${ROLE}\b[\s\S]*?\bin\s+(?:role|group)\s+(${ROLES})`, "iu");
-const CONFIG_CHANGE = /^(?:in\s+database\s+\S+\s+)?(?:set|reset)\s/iu;
-function roleName(name) {
-	return name.replaceAll("\"", "").toLowerCase();
-}
-function roleList(list) {
-	return list.split(",").map((name) => roleName(name.trim()));
-}
-function rejection(text) {
-	const alter = ALTER_ROLE.exec(text);
-	if (alter !== null) {
-		const role = roleName(group(alter, 2));
-		const rest = group(alter, 3);
-		if (group(alter, 1).toLowerCase() === "group" && /^add\s/iu.test(rest)) return RESERVED_MEMBERSHIPS.has(role) ? `grants membership in the reserved role ${role}` : void 0;
-		if (!RESERVED_ROLES.has(role) || CONFIGURABLE_ROLES.has(role) && CONFIG_CHANGE.test(rest)) return;
-		return `changes the reserved role ${role}`;
-	}
-	const drop = DROP_ROLE.exec(text);
-	if (drop !== null) {
-		const role = roleList(group(drop, 1)).find((name) => RESERVED_ROLES.has(name));
-		return role === void 0 ? void 0 : `drops the reserved role ${role}`;
-	}
-	const grant = GRANT_ROLE.exec(text);
-	const granted = CREATE_IN_ROLE.exec(text)?.[1] ?? (grant === null || /\bon\b/iu.test(group(grant, 1)) ? void 0 : group(grant, 1));
-	if (granted === void 0) return;
-	const role = roleList(granted).find((name) => RESERVED_MEMBERSHIPS.has(name));
-	return role === void 0 ? void 0 : `grants membership in the reserved role ${role}`;
-}
-/**
-* The statements of `sql` that supautils rejects for a non-superuser:
-* changing or dropping a reserved role, other than `set` or `reset` on the
-* four API roles, and granting a reserved membership.
-*/
-function supautilsRejections(sql) {
-	return sqlStatements(sql).flatMap(({ line, text }) => {
-		const reason = rejection(text);
-		return reason === void 0 ? [] : [{
-			line,
-			reason
-		}];
-	});
-}
-//#endregion
-export { supautilsRejections as t };

package/dist/text-diff-BQcUapOb.js

@@ -1,15 +0,0 @@
-import { createTwoFilesPatch } from "diff";
-//#region src/cli/core/text-diff.ts
-const MAX_LINES = 40;
-/**
-* A unified diff from the file on disk to what the command would write,
-* cut to the first {@link MAX_LINES} lines so a CI log stays readable.
-*/
-function shortDiff(file, onDisk, next) {
-	const lines = createTwoFilesPatch(`${file} (on disk)`, `${file} (generated)`, onDisk, next, void 0, void 0, { context: 2 }).split("\n").filter((line) => !line.startsWith("=====")).filter((line, index, all) => line !== "" || index < all.length - 1);
-	if (lines.length <= MAX_LINES) return lines.join("\n");
-	const rest = lines.length - MAX_LINES;
-	return [...lines.slice(0, MAX_LINES), `… ${rest} more diff line${rest === 1 ? "" : "s"}`].join("\n");
-}
-//#endregion
-export { shortDiff as t };

package/dist/types-B3_ooZgZ.d.ts

@@ -1,172 +0,0 @@
-import { $n as Delegation, Nn as Decision, Vt as Snapshot, dt as TokenVerifier, j as PolicyVocabulary, qn as Actor, rr as Principal } from "./policy-types-n0uRTsW8.js";
-import { w as Permission } from "./vocabulary-CN8H_9UF.js";
-import { r as PermDock } from "./permdock-SV8ZINYT.js";
-import { n as DescribeMessages, t as DecisionDescription } from "./describe-B5qgDvEW.js";
-//#region src/client/request.d.ts
-type StoreHeaders = Readonly<Record<string, string>>;
-//#endregion
-//#region src/client/store.d.ts
-type ClientStoreOptions = {
-  readonly snapshot: Snapshot | string;
-  readonly endpoint?: string;
-  readonly snapshotUrl?: string;
-  readonly approvals?: string;
-  readonly tenant?: string;
-  readonly fetch?: typeof fetch;
-  /** Request headers, or a getter read on every request so a rotated token needs no new store. */
-  readonly headers?: StoreHeaders | (() => StoreHeaders | undefined);
-  readonly maxAge?: number;
-  readonly verifier?: TokenVerifier;
-  /** `raw` is the compact JWS the snapshot was verified from, so a signed snapshot can be persisted signed. */
-  readonly onSnapshot?: (snapshot: Snapshot, tenant: string | undefined, raw: string | undefined) => void;
-  readonly onClear?: () => void;
-  /** Called once per key the snapshot cannot answer when there is no `endpoint` to ask. */
-  readonly onServerOnly?: (permission: Permission) => void;
-  /**
-   * `true` while rendering on the server: endpoint checks answer `pending`
-   * without a request. Defaults to `typeof window === 'undefined'`.
-   */
-  readonly server?: boolean;
-  /** Milliseconds between approval status polls. Defaults to 2000. */
-  readonly approvalInterval?: number;
-  /** Start `pending`: the snapshot arrives later through `track()`. */
-  readonly awaiting?: boolean;
-  /**
-   * The first snapshot that hydrates with a principal is a persisted copy:
-   * `stale` until a refresh or a `replace()` lands.
-   */
-  readonly stale?: boolean;
-  /**
-   * Reuse decisions for the same row object until the next microtask. Only for
-   * renderers that do not track the fields a check reads (React): Vue, Svelte
-   * and Solid would stop re-running when a reactive row changes in place.
-   */
-  readonly passCache?: boolean;
-};
-type ClientStore = {
-  get(): ClientPermDock;
-  subscribe(listener: () => void): () => void;
-  permissionState(permission: Permission, data?: unknown): PermissionState;
-  requestApproval(decision: Decision, note?: string): Promise<void>;
-  /** Hydrate from a pushed snapshot; a compact JWS goes through the verifier. */
-  replace(value: unknown): void;
-  /** Stay `pending` until `value` settles, then hydrate; a rejection fails closed. */
-  follow(value: PromiseLike<Snapshot | string>): void;
-  /**
-   * `follow()` once per `value`, without suspending. A thenable React already
-   * settled (`status: 'fulfilled'`) hydrates at once.
-   */
-  track(value: PromiseLike<Snapshot | string>): void;
-  /**
-   * The approval state for a decision. While something subscribes, an
-   * `approval-required` decision is polled at `<approvals>/<token>`.
-   */
-  approvalState(decision: Decision): ApprovalState;
-  /**
-   * Hydrate from a resolved `snapshotPromise` during render. Idempotent per `source`;
-   * subscribers are notified in a microtask, never synchronously inside render.
-   */
-  adopt(value: Snapshot | string, source: object): void;
-  snapshot(): Snapshot;
-  /** The tenant the store currently answers for. */
-  tenant(): string | undefined;
-  /** Stops polls, drops in-flight results and persistence; the store keeps answering from its last snapshot. */
-  dispose(): void;
-};
-//#endregion
-//#region src/client/types.d.ts
-type ClientStatus = "ready" | "pending" | "stale" | "server-only";
-type PermissionState = {
-  readonly allowed: boolean;
-  readonly status: ClientStatus;
-  readonly decision: Decision;
-};
-type PermissionSet = {
-  readonly granted: readonly Permission[];
-  get(permission: Permission): PermissionState | undefined;
-};
-type ClientPermDock<V extends PolicyVocabulary = PolicyVocabulary> = PermDock<V> & {
-  status(permission?: Permission, data?: unknown): ClientStatus;
-  invalidate(ref: Permission | {
-    readonly [key: string]: unknown;
-  }): void;
-  refresh(options?: {
-    readonly tenant?: string;
-  }): Promise<void>;
-  clear(): void;
-  subscribe(listener: () => void): () => void;
-};
-type ApprovalState = "not-needed" | "required" | "pending" | "approved" | "rejected" | "expired";
-type ApprovalHandle = {
-  readonly state: ApprovalState;
-  readonly token: string | undefined;
-  readonly request: (note?: string) => Promise<void>;
-};
-type SubjectView = {
-  readonly principal: Principal | null;
-  readonly actor: Actor | undefined;
-  readonly delegation: Delegation | undefined;
-  readonly expiresAt: number | undefined;
-  readonly simulated: boolean;
-};
-type TenantView = {
-  readonly tenant: string | null;
-  readonly tenants: readonly string[];
-  readonly switchTo: (id: string) => Promise<void>;
-  readonly status: ClientStatus;
-};
-type FilterResult<T> = readonly T[] & {
-  readonly partial: boolean;
-};
-type RolesOptions = {
-  readonly tenant?: string;
-  readonly team?: string;
-};
-/** The provider options Vue, Svelte and Solid share; each adds its own reactive `snapshot`, `tenant`, `headers`, `verifier` and `defaults`. */
-type ProviderOptionsBase = {
-  /**
-   * The AuthZEN evaluations endpoint for checks the snapshot cannot answer.
-   * `false` never calls one: such a check is denied with reason `server-only`.
-   */
-  readonly endpoint?: string | false;
-  /** Where `refresh()` fetches a fresh snapshot. Defaults to `endpoint`. */
-  readonly snapshotUrl?: string;
-  readonly approvals?: string;
-  /** Read on every request, so a new `fetch` applies without a new store. */
-  readonly fetch?: typeof fetch;
-  readonly maxAge?: number;
-  /** Localised text for the describe helper. */
-  readonly messages?: DescribeMessages;
-  /** Called with each snapshot the store accepts. */
-  readonly onSnapshot?: NonNullable<ClientStoreOptions["onSnapshot"]>;
-  /** Called when the store drops its snapshot. */
-  readonly onClear?: () => void;
-  /** Milliseconds between approval status polls. Defaults to 2000. */
-  readonly approvalInterval?: number;
-};
-/** How a control shows a permission it cannot use: hidden, or disabled with a reason. */
-type GateMode = "hide" | "disable";
-/**
- * Everything a permission-gated control renders from, in one value: a
- * button, a menu item or a link reads these fields and decides nothing
- * itself. The client is a hint; the server checks again.
- */
-type GateView = {
-  /** The decision granted the action. */
-  readonly allowed: boolean;
-  /** The snapshot is loading; render the control disabled, not hidden. */
-  readonly pending: boolean;
-  /** `mode: "hide"` and the action is not available: render nothing. */
-  readonly hidden: boolean;
-  /** The control cannot run the action now (denied, pending or awaiting approval). */
-  readonly disabled: boolean;
-  /** The decision needs a person's approval first; offer to request it. */
-  readonly needsApproval: boolean;
-  /** The plans that would grant the action, for an upgrade prompt; empty otherwise. */
-  readonly upgrade: readonly string[];
-  /** Title and detail for a tooltip or an accessible description. */
-  readonly reason: DecisionDescription;
-  readonly decision: Decision;
-};
-//#endregion
-export { FilterResult as a, PermissionSet as c, RolesOptions as d, SubjectView as f, ClientStoreOptions as h, ClientStatus as i, PermissionState as l, ClientStore as m, ApprovalState as n, GateMode as o, TenantView as p, ClientPermDock as r, GateView as s, ApprovalHandle as t, ProviderOptionsBase as u };

package/dist/usage-CZpSQP6L.js

@@ -1 +0,0 @@
-export { t as runUsage } from "./usage-SveTRTyr.js";

package/dist/version-CEbQ5UeM.js

@@ -1,18 +0,0 @@
-import { t as packageRoot } from "./package-root-Dk_ETdkp.js";
-import { readFileSync } from "node:fs";
-import { join } from "node:path";
-//#region src/cli/core/version.ts
-function cliVersion() {
-	return JSON.parse(readFileSync(join(packageRoot(), "package.json"), "utf8")).version;
-}
-function generatorBanner() {
-	return `permdock@${cliVersion()}`;
-}
-const CATALOG_SCHEMA = "https://permdock.com/schemas/catalog-v1.json";
-const SUPABASE_MANIFEST_SCHEMA = "https://permdock.com/schemas/supabase-manifest-v1.json";
-const USAGE_REPORT_SCHEMA = "https://permdock.com/schemas/usage-report-v1.json";
-const DOCTOR_REPORT_SCHEMA = "https://permdock.com/schemas/doctor-report-v1.json";
-const CONFIG_REPORT_SCHEMA = "https://permdock.com/schemas/config-report-v1.json";
-const ARAZZO_REPORT_SCHEMA = "https://permdock.com/schemas/arazzo-report-v1.json";
-//#endregion
-export { SUPABASE_MANIFEST_SCHEMA as a, generatorBanner as c, DOCTOR_REPORT_SCHEMA as i, CATALOG_SCHEMA as n, USAGE_REPORT_SCHEMA as o, CONFIG_REPORT_SCHEMA as r, cliVersion as s, ARAZZO_REPORT_SCHEMA as t };

package/dist/version-DXkYUISx.js

@@ -1 +0,0 @@
-export { s as cliVersion } from "./version-CEbQ5UeM.js";

package/dist/watch--ovlPOc0.js

@@ -1 +0,0 @@
-export { i as watchCollect } from "./watch-vea54PRw.js";