permdock 0.6.0 → 0.8.0

package/dist/fields-D0vUI6dq.js

@@ -0,0 +1,498 @@
+import { a as sole } from "./compact-CAf557ZB.js";
+import { i as configError } from "./errors-Vpu6rKHl.js";
+import { c as jsonSchemaOf } from "./catalog-doc-DjMKzJp9.js";
+import { A as quoteQualified, D as qualified, E as helperSchema, O as quoteIdent, _ as subjectClaimJsonSql, k as quoteLiteral, s as signedIn } from "./shared-Afctg7B0.js";
+//#region src/cli/sql/clauses.ts
+/**
+* True when `sql` is one parenthesised expression, so AND / OR need not wrap it
+* again.
+*/
+function isWrapped(sql) {
+	if (!sql.startsWith("(") || !sql.endsWith(")")) return false;
+	let depth = 0;
+	let quoted = false;
+	for (let index = 0; index < sql.length; index += 1) {
+		const ch = sql[index];
+		if (ch === "'") quoted = !quoted;
+		else if (!quoted && ch === "(") depth += 1;
+		else if (!quoted && ch === ")") {
+			depth -= 1;
+			if (depth === 0 && index < sql.length - 1) return false;
+		}
+	}
+	return depth === 0;
+}
+function wrapSql(sql) {
+	return isWrapped(sql) ? sql : `(${sql})`;
+}
+/**
+* The grant's `validFrom` / `validUntil` as a clock check: `from` inclusive,
+* `until` exclusive, matching the in-process evaluator.
+*/
+function validitySql(validity) {
+	if (validity === void 0) return;
+	return andSql(validity.from === void 0 ? void 0 : `now() >= to_timestamp(${validity.from})`, validity.until === void 0 ? void 0 : `now() < to_timestamp(${validity.until})`);
+}
+function andSql(...parts) {
+	const present = parts.filter((part) => part !== void 0 && part !== "true");
+	if (present.length === 0) return;
+	return present.length === 1 ? present[0] : present.map(wrapSql).join(" and ");
+}
+/**
+* `USING` and `WITH CHECK` for a branch: its access check ANDed with its row
+* conditions.
+*/
+function branchClauses(branch) {
+	const using = branch.command === "insert" ? void 0 : andSql(branch.access, branch.using) ?? "true";
+	const check = branch.command === "insert" || branch.command === "update" ? andSql(branch.access, branch.check) ?? "true" : void 0;
+	return {
+		...using === void 0 ? {} : { using },
+		...check === void 0 ? {} : { check }
+	};
+}
+//#endregion
+//#region src/cli/rls/policies.ts
+/**
+* Each database role gets its own policy, so no role sees two permissive
+* policies for one command.
+*/
+const AUDIENCES = ["authenticated", "anon"];
+const DEFAULT_POLICY_NAME = "{table}_{op}";
+const DEFAULT_PER_ROLE_NAME = "{role}_{permission}";
+const PLACEHOLDER = /\{(table|op|role|permission)\}/gu;
+function sanitize(name) {
+	return name.replaceAll(/[^A-Za-z0-9_]/gu, "_");
+}
+function render(template, values) {
+	return sanitize(template.replaceAll(PLACEHOLDER, (_match, key) => values[key]));
+}
+/**
+* Rejects a template that cannot name every policy of the chosen shape
+* uniquely.
+*/
+function assertPolicyName(template, perRole) {
+	if (!perRole && /\{(role|permission)\}/u.test(template)) throw configError("PermDock CLI: --policy-name {role} and {permission} need --policy-per-role; a collapsed policy covers several roles");
+	if (!perRole && !(template.includes("{table}") && template.includes("{op}"))) throw configError("PermDock CLI: --policy-name needs {table} and {op} so each table and command gets its own policy");
+}
+function orSql(parts) {
+	const distinct = [...new Set(parts)];
+	if (distinct.includes("true")) return "true";
+	return sole(distinct) ?? distinct.map(wrapSql).join(" or ");
+}
+function negate(sql) {
+	return sql === void 0 ? void 0 : `(${sql}) is not true`;
+}
+function policyOf(name, branch, using, check) {
+	const deny = branch.effect === "deny";
+	const policy = {
+		name,
+		table: branch.table,
+		command: branch.command,
+		effect: branch.effect,
+		roles: branch.roles
+	};
+	const finalUsing = deny ? negate(using) : using;
+	const finalCheck = deny ? negate(check) : check;
+	if (finalUsing !== void 0) policy.using = finalUsing;
+	if (finalCheck !== void 0) policy.check = finalCheck;
+	return policy;
+}
+function uniqueName(names, name) {
+	const seen = names.get(name) ?? 0;
+	names.set(name, seen + 1);
+	return seen === 0 ? name : `${name}_${seen + 1}`;
+}
+function perRolePolicies(branches, template) {
+	const names = /* @__PURE__ */ new Map();
+	return branches.map((branch) => {
+		const clauses = branchClauses(branch);
+		const deny = branch.effect === "deny";
+		const base = render(template, {
+			table: branch.table,
+			op: branch.command,
+			role: branch.label,
+			permission: branch.permissionKey
+		});
+		const name = `${deny ? "deny_" : ""}${base}${branch.coverage === true ? "_select_coverage" : ""}`;
+		return policyOf(uniqueName(names, name), branch, clauses.using, clauses.check);
+	});
+}
+/**
+* Branches of one grant-key group share their row condition, so the group
+* becomes one OR branch whose access ORs the helper calls of each scope.
+*/
+function mergeGroups(branches) {
+	const merged = [];
+	const byKey = /* @__PURE__ */ new Map();
+	for (const branch of branches) {
+		const id = branch.grantKey === void 0 ? void 0 : `${branch.table}\u0000${branch.command}\u0000${branch.grantKey}\u0000${branch.coverage === true}`;
+		const entry = id === void 0 ? void 0 : byKey.get(id);
+		if (entry === void 0) {
+			const created = {
+				branch,
+				accesses: branch.access === void 0 ? [] : [branch.access]
+			};
+			if (id !== void 0) byKey.set(id, created);
+			merged.push(created);
+			continue;
+		}
+		if (branch.access !== void 0 && !entry.accesses.includes(branch.access)) entry.accesses.push(branch.access);
+	}
+	return merged.map(({ branch, accesses }) => accesses.length <= 1 ? branch : withAccess(branch, orSql(accesses)));
+}
+function withAccess(branch, access) {
+	return {
+		...branch,
+		access
+	};
+}
+function collapsedPolicies(branches, template) {
+	const groups = /* @__PURE__ */ new Map();
+	for (const branch of mergeGroups(branches)) {
+		const id = `${branch.table}\u0000${branch.command}\u0000${branch.effect}`;
+		groups.set(id, [...groups.get(id) ?? [], branch]);
+	}
+	const names = /* @__PURE__ */ new Map();
+	return [...groups.values()].flatMap((group) => AUDIENCES.flatMap((audience) => {
+		const members = group.filter((branch) => branch.roles.includes(audience));
+		const [first] = members;
+		if (first === void 0) return [];
+		const deny = first.effect === "deny";
+		const clauses = members.map(branchClauses);
+		const usings = clauses.flatMap((item) => item.using === void 0 ? [] : [item.using]);
+		const checks = clauses.flatMap((item) => item.check === void 0 ? [] : [item.check]);
+		const base = render(template, {
+			table: first.table,
+			op: first.command,
+			role: first.label,
+			permission: first.permissionKey
+		});
+		return [policyOf(uniqueName(names, `${deny ? "deny_" : ""}${base}${audience === "anon" ? "_anon" : ""}`), {
+			...first,
+			roles: [audience]
+		}, usings.length === 0 ? void 0 : orSql(usings), checks.length === 0 ? void 0 : orSql(checks))];
+	}));
+}
+/**
+* Assembles policies. The default is one PERMISSIVE policy per table, command
+* and database role (Splinter `multiple_permissive_policies` stays quiet), with
+* denies in one RESTRICTIVE policy per table, command and role.
+*/
+function assemblePolicies(branches, shape) {
+	const template = shape.name ?? (shape.perRole ? DEFAULT_PER_ROLE_NAME : DEFAULT_POLICY_NAME);
+	assertPolicyName(template, shape.perRole);
+	return shape.perRole ? perRolePolicies(branches, template) : collapsedPolicies(branches, template);
+}
+const DEFAULT_READ_ONLY_ACTORS = ["support", "impersonation"];
+const ACTOR_KIND = /^[a-z][a-z0-9_-]*$/u;
+/** The actor kinds `rls.readOnlyActors` names, or `undefined` when it is off. */
+function readOnlyActorKinds(setting) {
+	if (setting === void 0 || setting === false) return;
+	const kinds = setting === true ? DEFAULT_READ_ONLY_ACTORS : setting;
+	if (kinds.length === 0 || kinds.some((kind) => !ACTOR_KIND.test(kind))) throw configError("PermDock CLI: rls.readOnlyActors must be true or a non-empty list of actor kinds such as 'support'");
+	return [...new Set(kinds)];
+}
+/**
+* `permdock_actor_may_write()`, for hand-written write policies. Names are part
+* of the SQL contract.
+*/
+const ACTOR_MAY_WRITE = "permdock_actor_may_write";
+/**
+* True unless the token's `act` claim (`act`, as SQL `jsonb`) is a session of
+* one of `kinds` that is not `read_only: false`, or an agent with `read_only:
+* true` (agents default to writable, as better-supabase reads them).
+*/
+function readOnlyActorPasses(act, kinds) {
+	const list = `array[${kinds.map((kind) => `'${kind}'`).join(", ")}]::text[]`;
+	const passes = `(not coalesce(${kinds.includes("support") ? `(${act} ->> 'kind') = any(${list}) or ((${act} ->> 'kind') is null and ${act} ? 'session_id')` : `(${act} ->> 'kind') = any(${list})`}, false) or coalesce((${act} ->> 'read_only') = 'false', false))`;
+	return kinds.includes("agent") ? passes : `${passes} and not coalesce((${act} ->> 'kind') = 'agent' and (${act} ->> 'read_only') = 'true', false)`;
+}
+/**
+* `permdock_actor_may_write()`: {@link readOnlyActorPasses} as a function, so
+* hand-written write policies apply the same read-only default.
+*/
+function actorMayWriteSql(ctx, kinds) {
+	const fn = qualified(ctx, ACTOR_MAY_WRITE);
+	return `-- rls.readOnlyActors: false for a token whose act claim is a read-only ${kinds.join(" or ")} session; hand-written write policies call it
+create or replace function ${fn}()
+returns boolean
+language sql
+stable
+set search_path = ''
+as $$
+  select ${readOnlyActorPasses(subjectClaimJsonSql(ctx, "act"), kinds)}
+$$;
+revoke execute on function ${fn}() from public, anon;
+grant execute on function ${fn}() to authenticated;
+`;
+}
+/**
+* One restrictive policy per table and write command the allow policies grant
+* to `authenticated`: the write passes unless the token's `act` claim (`act`,
+* as SQL `jsonb`) is a session of one of `kinds` that is not `read_only:
+* false`. Reads are never touched.
+*/
+function readOnlyActorPolicies(policies, act, kinds) {
+	const passes = readOnlyActorPasses(act, kinds);
+	const seen = /* @__PURE__ */ new Set();
+	const out = [];
+	for (const policy of policies) {
+		const key = `${policy.table}\u0000${policy.command}`;
+		if (policy.effect !== "allow" || policy.command === "select" || !policy.roles.includes("authenticated") || seen.has(key)) continue;
+		seen.add(key);
+		out.push({
+			name: sanitize(`${policy.table}_${policy.command}_read_only_actors`),
+			table: policy.table,
+			command: policy.command,
+			effect: "deny",
+			roles: ["authenticated"],
+			...policy.command === "insert" ? {} : { using: passes },
+			...policy.command === "delete" ? {} : { check: passes }
+		});
+	}
+	return out;
+}
+//#endregion
+//#region src/cli/rls/fields.ts
+/** Names of the field-view objects. Part of the SQL contract. */
+const FIELD_VIEWS = {
+	/** `<table>_visible`: the `security_invoker` view clients read. */
+	view: "_visible",
+	/**
+	* `<table>_visible_fields`: the owner-rights companion `--revoke-columns`
+	* adds.
+	*/
+	companion: "_visible_fields",
+	/** The companion's row-key column, joined to the base table's key. */
+	key: "permdock_key",
+	/** Marks the companion so doctor PD022 knows it reads as its owner on purpose. */
+	comment: "permdock:field-companion",
+	/** `<table>_mask(p_row)`: the row-masking function `fields: 'mask'` adds. */
+	mask: "_mask"
+};
+function covers(branch, column) {
+	return branch.fields === void 0 || branch.fields.includes(column);
+}
+/**
+* A read grant that only shapes columns: a field-limited deny (it never denies
+* the row) or an allow with an empty list (it grants nothing). With field views
+* it leaves the row policy and lives in the view's masks.
+*/
+function fieldOnly(branch) {
+	if (branch.command !== "select" || branch.fields === void 0) return false;
+	return branch.effect === "deny" || branch.fields.length === 0;
+}
+/** Branches the row policies keep when field views compile. */
+function rowBranches(branches) {
+	return branches.filter((branch) => !fieldOnly(branch));
+}
+/**
+* Whether the reader is signed in, for branches with no helper call: a grant to
+* any signed-in user relies on `to authenticated` in its policy, which a view
+* does not have.
+*/
+function audience(ctx, branch) {
+	if (branch.access !== void 0 || branch.roles.length !== 1) return;
+	if (branch.roles[0] === "authenticated") return signedIn(ctx);
+	return branch.roles[0] === "anon" ? `not (${signedIn(ctx)})` : void 0;
+}
+function clause(ctx, branch) {
+	return andSql(audience(ctx, branch), branchClauses(branch).using) ?? "true";
+}
+/**
+* `can(permission, row, { field })` in SQL: an allow that covers the column
+* holds for the row and no covering deny does. Every access term is the
+* uncorrelated helper call the row policy uses, so it runs once per statement.
+*/
+function maskSql(ctx, allows, denies, column) {
+	const allowed = allows.filter((branch) => covers(branch, column)).map((branch) => clause(ctx, branch));
+	if (allowed.length === 0) return "false";
+	const denied = denies.filter((branch) => covers(branch, column)).map((branch) => clause(ctx, branch));
+	const allow = orSql(allowed);
+	if (denied.length === 0) return allow;
+	const deny = orSql(denied);
+	return allow === "true" ? `not ${wrapSql(deny)}` : `${wrapSql(allow)} and not ${wrapSql(deny)}`;
+}
+function schemaColumns(policy, resource) {
+	const node = policy.resources.get(resource);
+	const schema = node === void 0 ? null : jsonSchemaOf(node);
+	const properties = schema !== null && typeof schema === "object" ? schema.properties : void 0;
+	return properties !== null && typeof properties === "object" ? Object.keys(properties) : void 0;
+}
+function viewName(table, suffix) {
+	return `${table}${suffix}`;
+}
+/**
+* `<helper schema>.<table><suffix>`: outside the Data API's schemas, so the
+* companion's owner rights reach clients only through the `_visible` join and
+* the mask function is neither an RPC nor a computed field.
+*/
+function helperObjectName(ctx, table, suffix) {
+	const base = table.startsWith("public.") ? table.slice(7) : table.replaceAll(".", "_");
+	return `${helperSchema(ctx)}.${viewName(base, suffix)}`;
+}
+/**
+* One view per table whose read grants limit fields. A column is restricted
+* when some read allow lists fields without it or some read deny lists it;
+* every other column, and the row key, passes through unchanged.
+*/
+function fieldViews(policy, ctx, branches, options, warnings) {
+	const byTable = /* @__PURE__ */ new Map();
+	for (const branch of branches) {
+		if (branch.command !== "select" || branch.coverage === true) continue;
+		byTable.set(branch.table, [...byTable.get(branch.table) ?? [], branch]);
+	}
+	const views = [];
+	for (const [table, reads] of byTable) {
+		const allows = reads.filter((branch) => branch.effect === "allow" && branch.fields?.length !== 0);
+		const denies = reads.filter((branch) => branch.effect === "deny");
+		const limited = reads.some((branch) => branch.fields !== void 0);
+		const resource = reads.find((branch) => branch.resource !== void 0)?.resource;
+		if (!limited || allows.length === 0 || resource === void 0) continue;
+		const names = schemaColumns(policy, resource);
+		if (names === void 0) throw configError(`PermDock CLI: --fields ${options.mask === true ? "mask" : "views"} needs the ${resource} schema's JSON Schema (Standard JSON Schema) to list the columns of ${table}`);
+		const key = policy.resources.get(resource)?.id ?? "id";
+		const restricted = (column) => column !== key && (allows.some((branch) => branch.fields !== void 0 && !branch.fields.includes(column)) || denies.some((branch) => branch.fields?.includes(column) === true));
+		const columns = names.map((name) => {
+			quoteIdent(name);
+			return restricted(name) ? {
+				name,
+				mask: maskSql(ctx, allows, denies, name)
+			} : { name };
+		});
+		if (columns.every((column) => column.mask === void 0)) continue;
+		const view = viewName(table, FIELD_VIEWS.view);
+		if (allows.some((branch) => branch.fields !== void 0 && !branch.fields.includes(key))) warnings.push(`field view ${view}: the key ${key} passes through, although a read grant on ${resource} omits it`);
+		const hidden = columns.filter((column) => column.mask !== void 0).map((column) => column.name);
+		if (options.helpersOnly === true) warnings.push(`field view ${view}: ${table} still returns ${hidden.join(", ")} to direct reads; revoke select on those columns from client roles in your own grants, or read them through a function`);
+		else if (!options.revokeColumns) warnings.push(`field view ${view}: ${table} still returns ${hidden.join(", ")} to direct reads; add --revoke-columns so clients read through the view`);
+		views.push({
+			resource,
+			table,
+			view,
+			key,
+			columns,
+			roles: reads.some((branch) => branch.roles.includes("anon")) ? ["anon", "authenticated"] : ["authenticated"],
+			...options.revokeColumns ? { companion: helperObjectName(ctx, table, FIELD_VIEWS.companion) } : {},
+			...options.mask === true ? { maskFunction: helperObjectName(ctx, table, FIELD_VIEWS.mask) } : {}
+		});
+	}
+	return views;
+}
+/**
+* Columns of `view`'s table that `anon` and `authenticated` keep on the base
+* table with `--revoke-columns`.
+*/
+function readableColumns(view) {
+	return view.columns.filter((column) => column.mask === void 0).map((column) => column.name);
+}
+function restrictedColumns(view) {
+	return view.columns.filter((column) => column.mask !== void 0).map((column) => column.name);
+}
+function columnList(names) {
+	return names.map(quoteIdent).join(", ");
+}
+function selectList(lines) {
+	return lines.map((line) => `  ${line}`).join(",\n");
+}
+function grantView(name, roles) {
+	return [`revoke all on table ${quoteQualified(name)} from anon, authenticated, public;`, `grant select on table ${quoteQualified(name)} to ${roles.join(", ")};`].join("\n");
+}
+function inlineViewSql(view) {
+	const targets = view.columns.map((column) => column.mask === void 0 ? quoteIdent(column.name) : `case when ${column.mask} then ${quoteIdent(column.name)} end as ${quoteIdent(column.name)}`);
+	return `create or replace view ${quoteQualified(view.view)} with (security_invoker = true) as
+select
+${selectList(targets)}
+from ${quoteQualified(view.table)};`;
+}
+function companionSql(view, companion) {
+	const restricted = view.columns.filter((column) => column.mask !== void 0);
+	const targets = [`${quoteIdent(view.key)} as ${quoteIdent(FIELD_VIEWS.key)}`, ...restricted.map((column) => `case when ${column.mask} then ${quoteIdent(column.name)} end as ${quoteIdent(column.name)}`)];
+	const any = orSql(restricted.map((column) => column.mask ?? "false"));
+	const name = companion.slice(0, companion.indexOf("."));
+	const schema = quoteIdent(name);
+	return `${name === "public" ? "" : `create schema if not exists ${schema};
+revoke all on schema ${schema} from public;
+grant usage on schema ${schema} to ${view.roles.join(", ")};
+`}create or replace view ${quoteQualified(companion)} with (security_barrier = true) as
+select
+${selectList(targets)}
+from ${quoteQualified(view.table)}
+where ${any};
+comment on view ${quoteQualified(companion)} is ${quoteLiteral(`${FIELD_VIEWS.comment} ${view.view}`)};`;
+}
+function joinedViewSql(view, companion) {
+	const targets = view.columns.map((column) => column.mask === void 0 ? `t.${quoteIdent(column.name)}` : `f.${quoteIdent(column.name)}`);
+	return `create or replace view ${quoteQualified(view.view)} with (security_invoker = true) as
+select
+${selectList(targets)}
+from ${quoteQualified(view.table)} t
+left join ${quoteQualified(companion)} f on f.${quoteIdent(FIELD_VIEWS.key)} = t.${quoteIdent(view.key)};`;
+}
+/**
+* `select` on only the unrestricted columns (and the key) of the base table,
+* for `--revoke-columns`.
+*/
+function columnGrantSql(view, role) {
+	return `grant select (${columnList(readableColumns(view))}) on table ${quoteQualified(view.table)} to ${role};`;
+}
+function columnRevokeSql(view) {
+	return `revoke select (${columnList(restrictedColumns(view))}) on table ${quoteQualified(view.table)} from anon, authenticated;`;
+}
+/**
+* `<table>_mask(p_row)`: the row with each restricted column the caller may not
+* read set to null, by the same masks as the view. It reads only the row it is
+* given, so its caller decides which rows; `security invoker`, because it needs
+* nothing beyond the helpers the masks call. The body names the parameter `$1`,
+* since a column called `p_row` would shadow the name.
+*/
+function maskFunctionSql(view, fn) {
+	const table = quoteQualified(view.table);
+	const name = quoteQualified(fn);
+	const nulls = view.columns.flatMap((column) => column.mask === void 0 ? [] : [`case when ${column.mask} then '{}'::jsonb else pg_catalog.jsonb_build_object(${quoteLiteral(column.name)}, null) end`]);
+	return `-- ${fn}: a row of ${view.table} with ${restrictedColumns(view).join(", ")} null unless a read grant covers the column for the row, for SQL that reads ${view.table} without ${view.view}
+create or replace function ${name}(p_row ${table})
+returns ${table}
+language sql
+stable
+security invoker
+set search_path = ''
+as $$
+  select pg_catalog.jsonb_populate_record(
+    $1,
+    ${nulls.join("\n    || ")}
+  )
+  from (select ($1).*) r
+$$;
+revoke all on function ${name}(${table}) from public, anon, authenticated;
+grant execute on function ${name}(${table}) to ${view.roles.join(", ")};`;
+}
+/**
+* The view SQL: the `security_invoker` view, and with `--revoke-columns` the
+* owner-rights companion it joins for the restricted columns. The companion
+* masks every column with the full field decision and keeps only rows where one
+* is readable, so reading it directly shows nothing `pick` would not.
+*/
+function fieldViewsSql(views) {
+	return views.map((view) => {
+		const head = `-- field view over ${view.table}: ${restrictedColumns(view).join(", ")} read as null unless a read grant covers the column for the row`;
+		const mask = view.maskFunction === void 0 ? [] : [maskFunctionSql(view, view.maskFunction)];
+		if (view.companion === void 0) return [
+			head,
+			inlineViewSql(view),
+			grantView(view.view, view.roles),
+			...mask
+		].join("\n");
+		return [
+			head,
+			`-- ${view.companion} reads ${view.table} as its owner; ${view.view} reads the rows as the caller and joins it`,
+			companionSql(view, view.companion),
+			grantView(view.companion, view.roles),
+			joinedViewSql(view, view.companion),
+			grantView(view.view, view.roles),
+			...mask
+		].join("\n");
+	}).join("\n\n");
+}
+//#endregion
+export { wrapSql as _, fieldViewsSql as a, ACTOR_MAY_WRITE as c, orSql as d, readOnlyActorKinds as f, validitySql as g, branchClauses as h, fieldViews as i, actorMayWriteSql as l, andSql as m, columnGrantSql as n, rowBranches as o, readOnlyActorPolicies as p, columnRevokeSql as r, viewName as s, FIELD_VIEWS as t, assemblePolicies as u };

package/dist/{files-C5ZI27eV.js → files-B3AA05f1.js}

@@ -1,10 +1,22 @@
-import { n as CliError } from "./errors-CWTY6uih.js";
-import { existsSync, mkdirSync, readFileSync, realpathSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { n as CliError } from "./errors-Vpu6rKHl.js";
+import { existsSync, mkdirSync, readFileSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { dirname, relative, resolve } from "node:path";
 import { execFileSync } from "node:child_process";
 //#region src/cli/core/files.ts
+/**
+* `/dev/null` and its kin: a rename over a device is refused, so it is written
+* in place.
+*/
+function isCharacterDevice(abs) {
+	try {
+		return statSync(abs).isCharacterDevice();
+	} catch {
+		return false;
+	}
+}
 function outcomeOf(abs, text) {
 	if (!existsSync(abs)) return "created";
+	if (isCharacterDevice(abs)) return "updated";
 	return readFileSync(abs, "utf8") === text ? "unchanged" : "updated";
 }
 /** What writing `files` would do, without writing. */
@@ -27,6 +39,10 @@ function applyFiles(cwd, files, options = {}) {
 		for (const [index, file] of files.entries()) {
 			if (planned[index]?.outcome === "unchanged") continue;
 			const target = resolve(cwd, file.path);
+			if (isCharacterDevice(target)) {
+				writeFileSync(target, file.text);
+				continue;
+			}
 			const temp = `${target}.permdock-${String(process.pid)}.tmp`;
 			mkdirSync(dirname(target), { recursive: true });
 			writeFileSync(temp, file.text);
@@ -58,8 +74,8 @@ function fileSummary(applied, dryRun) {
 	return applied.map((file) => `${VERBS[file.outcome][dryRun ? 1 : 0]} ${file.path}`).join("\n");
 }
 /**
-* The files among `paths` with uncommitted changes in git. Outside a git
-* work tree, or without git, nothing counts as dirty.
+* The files among `paths` with uncommitted changes in git. Outside a git work
+* tree, or without git, nothing counts as dirty.
 */
 function dirtyFiles(cwd, paths) {
 	if (paths.length === 0) return [];
@@ -121,4 +137,4 @@ function refuseDirty(input) {
 	});
 }
 //#endregion
-export { fileSummary as n, refuseDirty as r, applyFiles as t };
+export { refuseDirty as i, fileSummary as n, planFiles as r, applyFiles as t };

package/dist/{files-D_JIzUrP.js → files-BSjrtIHw.js}

@@ -37,7 +37,10 @@ function listSourceFiles(cwd, srcPath) {
 function segments(path) {
 	return path.split(/[\\/]/u).filter((part) => part !== "" && part !== ".");
 }
-/** Installed packages often ship only `dist`; their own dependencies are never walked. */
+/**
+* Installed packages often ship only `dist`; their own dependencies are never
+* walked.
+*/
 function skipDirsFor(path) {
 	return segments(path).includes("node_modules") ? PACKAGE_SKIP_DIRS : SKIP_DIRS;
 }
@@ -85,7 +88,8 @@ function walkDir(dir, out, skip) {
 /**
 * The `.sql` files under each entry: a glob, a file, or a directory searched
 * recursively. `order: 'entry'` keeps each entry's matches together in entry
-* order (how `supabase db diff` reads `schema_paths`); the default sorts all paths.
+* order (how `supabase db diff` reads `schema_paths`); the default sorts all
+* paths.
 */
 function sqlFiles(cwd, entries, options = {}) {
 	const seen = /* @__PURE__ */ new Set();
@@ -93,7 +97,7 @@ function sqlFiles(cwd, entries, options = {}) {
 	for (const entry of entries) {
 		const abs = resolve(cwd, entry);
 		const isGlob = /[*?[{]/u.test(entry);
-		if (!isGlob && statSync(abs, { throwIfNoEntry: false })?.isFile()) {
+		if (!isGlob && statSync(abs, { throwIfNoEntry: false })?.isFile() === true) {
 			if (!seen.has(abs)) {
 				seen.add(abs);
 				ordered.push(abs);
@@ -117,7 +121,10 @@ function rel(cwd, abs) {
 function defaultSrcPath() {
 	return ["./src"];
 }
-/** Where `doctor` reads source files: `doctor.srcPath`, else `collect.srcPath`, else `./src`. */
+/**
+* Where `doctor` reads source files: `doctor.srcPath`, else `collect.srcPath`,
+* else `./src`.
+*/
 function doctorSrcPath(config) {
 	return config.doctor?.srcPath ?? config.collect?.srcPath ?? defaultSrcPath();
 }

package/dist/{fixtures-B7XrLeY7.js → fixtures-A1_sp_tR.js}

@@ -1,7 +1,7 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
-import { i as configError } from "./errors-CWTY6uih.js";
-import { i as readJsonFile } from "./files-D_JIzUrP.js";
-import { a as loadModule, s as pickNamed } from "./load-DFS_ry0W.js";
+import { i as configError } from "./errors-Vpu6rKHl.js";
+import { i as readJsonFile } from "./files-BSjrtIHw.js";
+import { a as loadModule, s as pickNamed } from "./load-DjSU5KXO.js";
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 //#region src/cli/fixtures.ts
@@ -26,7 +26,10 @@ function asCustomRoles(value) {
 	if (!Array.isArray(value["customRoles"])) throw new TypeError("PermDock CLI: fixtures customRoles must be an array");
 	return value["customRoles"];
 }
-/** A `.json` file or a module exporting `fixtures` (or default) and optionally `customRoles`. */
+/**
+* A `.json` file or a module exporting `fixtures` (or default) and optionally
+* `customRoles`.
+*/
 async function loadFixtures(cwd, path) {
 	const abs = resolve(cwd, path);
 	if (!existsSync(abs)) throw configError(`PermDock CLI: fixtures not found: ${path}`);
@@ -43,7 +46,10 @@ async function loadFixtures(cwd, path) {
 		customRoles: asCustomRoles(mod)
 	};
 }
-/** The fixture subject as a `Subject`: a principal with no actor and an empty context. */
+/**
+* The fixture subject as a `Subject`: a principal with no actor and an empty
+* context.
+*/
 function fixtureSubject(fixture) {
 	return {
 		principal: {
@@ -56,7 +62,10 @@ function fixtureSubject(fixture) {
 		context: {}
 	};
 }
-/** The row `can` receives: `{ current, next }` for an instance action with a `newRow`. */
+/**
+* The row `can` receives: `{ current, next }` for an instance action with a
+* `newRow`.
+*/
 function fixtureRow(fixture, kind) {
 	return fixture.newRow === void 0 || kind === "collection" ? fixture.row : {
 		current: fixture.row,

package/dist/{flags-C3DktBDY.js → flags-DXjoTVbS.js}

@@ -1,5 +1,5 @@
-import { n as CliError } from "./errors-CWTY6uih.js";
-import { n as secretInput } from "./credentials-DPyHmYz5.js";
+import { n as CliError } from "./errors-Vpu6rKHl.js";
+import { n as secretInput } from "./credentials-CdDxp7jN.js";
 //#region src/cli/core/flags.ts
 /** The flag vocabulary shared with better-supabase: one spelling per meaning. */
 const dbUrlFlags = { "db-url-stdin": {

package/dist/{freeze-CrU8nQeX.js → freeze-jjan0lCv.js}

@@ -47,7 +47,10 @@ function isPlain(value) {
 	const proto = Object.getPrototypeOf(value);
 	return proto === Object.prototype || proto === null;
 }
-/** A deeply frozen copy of the plain objects and arrays in `value`; the caller's own objects stay writable. */
+/**
+* A deeply frozen copy of the plain objects and arrays in `value`; the caller's
+* own objects stay writable.
+*/
 function freezeCopy(value) {
 	if (value === null || typeof value !== "object") return value;
 	if (Array.isArray(value)) return Object.freeze(value.map((item) => freezeCopy(item)));