permdock 0.7.0 → 0.8.0

package/dist/{powersync-53ryOZip.js → powersync-DHNQX06W.js}

@@ -1,24 +1,25 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { c as isConditionDate, l as isConditionRef } from "./refs-CNJBiTFo.js";
-import { A as memoryCustomRoleSource, g as localSnapshotManifest } from "./src-DLFrtrrC.js";
-import { n as findPermission } from "./permission-registry-DpPtSKNZ.js";
-import { f as scopeList, s as resolveScope } from "./scopes-BHsc-wp-.js";
-import { c as policyLevels } from "./policy-DaJy4nK4.js";
+import { c as isConditionDate, l as isConditionRef } from "./refs-C8BKxc_e.js";
+import { A as memoryCustomRoleSource, g as localSnapshotManifest } from "./src-DZ0l9UAg.js";
+import { n as findPermission } from "./permission-registry-B8tYxPIt.js";
+import { f as scopeList, s as resolveScope } from "./scopes-0Up_UA2t.js";
+import { l as policyLevels } from "./policy-CLQ8__GF.js";
 import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
-import { t as getPermDock } from "./permdock-BfWEeMqk.js";
-import { u as usageResult } from "./errors-DpP_U6Bf.js";
-import { c as requirePolicy } from "./load-DxroEzH1.js";
-import { s as quoteSqlLiteral, t as SQL_IDENT } from "./sql-B96movIM.js";
-import { i as scopeMembershipTable, r as scopeColumn } from "./compile-BAEO5bOk.js";
-import "./sources-B-zYB4GS.js";
-import { t as applyFiles } from "./files-acUbNwWt.js";
-import { i as fileDrift } from "./output-files-CCMdcFWb.js";
-import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-BTMW6zgU.js";
-import { O as quoteIdent, a as customRolesOn, t as CUSTOM_ROLES } from "./shared-fMKOv8hP.js";
-import { F as collectGrants, I as roleNames, L as andConditions, M as assignableRoles, t as ownershipRules, z as contextRefs } from "./ownership-Z2LpxsGa.js";
+import { t as getPermDock } from "./permdock-L-_I_3zP.js";
+import { u as usageResult } from "./errors-Vpu6rKHl.js";
+import { c as requirePolicy } from "./load-DjSU5KXO.js";
+import { s as quoteSqlLiteral, t as SQL_IDENT } from "./sql-0WjxIp9g.js";
+import { a as scopeMembershipTable, i as scopeColumn } from "./compile-EzEMB-7v.js";
+import "./sources-CMAM-2A3.js";
+import { t as applyFiles } from "./files-B3AA05f1.js";
+import { i as fileDrift } from "./output-files-BIQ_9pIs.js";
+import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-A1_sp_tR.js";
+import { O as quoteIdent, a as customRolesOn, t as CUSTOM_ROLES } from "./shared-Afctg7B0.js";
+import { r as tableNames } from "./tables-DeMNEy6V.js";
+import { d as andConditions, l as collectGrants, o as assignableRoles, p as contextRefs, t as ownershipRules, u as roleNames } from "./ownership-B4L59T9u.js";
 import { t as membershipSourcesOf } from "./sources-qoIJQrJv.js";
-import { f as pgConnector } from "./policies-B2lZIurj.js";
-import { d as tableNames, t as canFixture, x as tableFor } from "./verify-pe8rL_Qw.js";
+import { n as pgConnector } from "./pg-DQTqRrou.js";
+import { m as tableFor, t as canFixture } from "./verify-DZeqoWu5.js";
 import { resolve } from "node:path";
 //#region src/cli/powersync/names.ts
 function ident(name) {
@@ -32,9 +33,9 @@ function parts(table) {
 	return [schema === "public" ? void 0 : schema, name];
 }
 /**
-* The name a stream query and the device use for the table: its own name,
-* or `<schema>_<table>` for a table outside `public` that shares its name
-* with another synced table, since PowerSync drops the schema on the device.
+* The name a stream query and the device use for the table: its own name, or
+* `<schema>_<table>` for a table outside `public` that shares its name with
+* another synced table, since PowerSync drops the schema on the device.
 */
 function bare(table, named) {
 	const [schema, name] = parts(table);
@@ -42,7 +43,10 @@ function bare(table, named) {
 	named.names?.seen.add(key);
 	return named.names?.renamed.get(key) ?? name;
 }
-/** The table as a stream query reads it: Sync Streams need a schema other than `public` in double quotes. */
+/**
+* The table as a stream query reads it: Sync Streams need a schema other than
+* `public` in double quotes.
+*/
 function quotedTable(table) {
 	const [schema, name] = parts(table);
 	return schema === void 0 ? name : `"${schema}"."${name}"`;
@@ -52,7 +56,10 @@ function fromTable(table, named) {
 	const [schema] = parts(table);
 	return schema === void 0 ? bare(table, named) : `${quotedTable(table)} AS ${bare(table, named)}`;
 }
-/** `<schema>_<table>` for each table outside `public` whose name another referenced table shares. */
+/**
+* `<schema>_<table>` for each table outside `public` whose name another
+* referenced table shares.
+*/
 function renames(seen) {
 	const byName = /* @__PURE__ */ new Map();
 	for (const table of seen) {
@@ -70,7 +77,10 @@ function renames(seen) {
 const CUSTOM_ROLE = "custom role";
 //#endregion
 //#region src/cli/powersync/sources.ts
-/** The sources that can hold scope `name`: every table source and the junction sources of that scope. */
+/**
+* The sources that can hold scope `name`: every table source and the junction
+* sources of that scope.
+*/
 function scopeSourcesOf(sources, name) {
 	return sources.filter((source) => source.sql.scope === void 0 || source.sql.scope === name);
 }
@@ -99,7 +109,10 @@ function roleSources(roles) {
 function anyOf(clauses) {
 	return clauses.length === 1 ? clauses[0] ?? "" : `(${clauses.join(" OR ")})`;
 }
-/** The user's own rows of the source, of scope `scope` when the source has a scope column. */
+/**
+* The user's own rows of the source, of scope `scope` when the source has a
+* scope column.
+*/
 function ownRows(stream, dialect, scope) {
 	const table = bare(stream.table, dialect);
 	const scoped = scope !== void 0 && "column" in stream.scope ? [`${dialect.column(table, stream.scope.column)} = ${dialect.literal(scope)}`] : [];
@@ -116,7 +129,10 @@ function ownRows(stream, dialect, scope) {
 		where: [`${dialect.column(users, stream.user.column)} = ${dialect.user}`, ...scoped]
 	};
 }
-/** The filter of one role source for role `role`; `undefined` when the source never holds it. */
+/**
+* The filter of one role source for role `role`; `undefined` when the source
+* never holds it.
+*/
 function roleFilter(stream, source, role, table, dialect) {
 	if (typeof source === "string") return {
 		join: "",
@@ -138,7 +154,10 @@ function roleFilter(stream, source, role, table, dialect) {
 		where: [`${dialect.column(keys, source.column)} = ${dialect.literal(role)}`, ...guarded].join(" AND ")
 	};
 }
-/** The kinds filter of role `role`: `[]` for none, `undefined` when no row of the source has one of its kinds. */
+/**
+* The kinds filter of role `role`: `[]` for none, `undefined` when no row of
+* the source has one of its kinds.
+*/
 function kindFilter(stream, role, table, ctx) {
 	const kinds = ctx.kinds[role];
 	if (kinds === void 0) return [];
@@ -170,7 +189,10 @@ function sourceIn(stream, scope, left, roles, ctx) {
 	}
 	return out;
 }
-/** The roles tables the source joins through, each with the query of the rows the user's own rows reference. */
+/**
+* The roles tables the source joins through, each with the query of the rows
+* the user's own rows reference.
+*/
 function roleTableRows(stream, dialect) {
 	if (isFixed(stream.roles)) return [];
 	const own = ownRows(stream, dialect);
@@ -232,10 +254,10 @@ function tableRows(table, scope, id, device) {
 	});
 }
 /**
-* The manifest's `rows`: the tables the subject streams sync, as a device
-* reads them. A scope's `rls.memberships` table, else its membership
-* sources; the global roles table; and the custom-role tables in `database`
-* mode. `devices` holds the plan's renamed tables.
+* The manifest's `rows`: the tables the subject streams sync, as a device reads
+* them. A scope's `rls.memberships` table, else its membership sources; the
+* global roles table; and the custom-role tables in `database` mode. `devices`
+* holds the plan's renamed tables.
 */
 function localRows(policy, config, devices) {
 	const names = { names: {
@@ -282,7 +304,10 @@ function localRows(policy, config, devices) {
 //#endregion
 //#region src/cli/powersync/levels.ts
 const ALIAS = "cr";
-/** The role key column of one role source, with the join to its roles table; `undefined` for a mapped column, which holds declared roles only. */
+/**
+* The role key column of one role source, with the join to its roles table;
+* `undefined` for a mapped column, which holds declared roles only.
+*/
 function roleKeyOf(role, table, dialect) {
 	if (typeof role === "string") return {
 		join: "",
@@ -300,8 +325,8 @@ function roleKeyOf(role, table, dialect) {
 /**
 * The `IN (SELECT …)` of each root-scope source: the row's `left` is a tenant
 * where the user holds a custom role with an allow row of `key` at `level`
-* (`null` for an allow with no level). A role column the source maps or
-* fixes holds declared roles only, so it never names a custom role.
+* (`null` for an allow with no level). A role column the source maps or fixes
+* holds declared roles only, so it never names a custom role.
 */
 function customRoleIn(ctx, root, left, key, level) {
 	const { dialect } = ctx;
@@ -336,12 +361,12 @@ function customRoleIn(ctx, root, left, key, level) {
 	return out;
 }
 /**
-* What a custom role can reach on `resource` through `key`, in `database`
-* mode when the root scope reads membership sources: each allow of `key` by
-* an assignable role at the root scope (the ceiling), once for an allow with
-* no level and once per level the resource declares, narrowed by that
-* level's condition. `skipped` says why a root scope with custom roles
-* reaching `key` has no custom-role stream.
+* What a custom role can reach on `resource` through `key`, in `database` mode
+* when the root scope reads membership sources: each allow of `key` by an
+* assignable role at the root scope (the ceiling), once for an allow with no
+* level and once per level the resource declares, narrowed by that level's
+* condition. `skipped` says why a root scope with custom roles reaching `key`
+* has no custom-role stream.
 */
 function customRoleItems(ctx, grants, resource, key, table) {
 	const rls = ctx.config.rls;
@@ -389,7 +414,10 @@ const POSTGRES = {
 	column: (table, name, numeric) => `${table}.${ident(name)}${numeric === true ? "" : "::text"}`,
 	literal: (value) => typeof value === "number" ? String(value) : quoteSqlLiteral(String(value))
 };
-/** At most this many queries per stream; a wider `or` product is left out rather than truncated. */
+/**
+* At most this many queries per stream; a wider `or` product is left out rather
+* than truncated.
+*/
 const MAX_QUERIES = 32;
 /** Every combination of one clause list from each input, ANDed. */
 function product(lists) {
@@ -405,7 +433,10 @@ function every(parts) {
 	}
 	return out;
 }
-/** A row value: a literal, or a principal ref the token carries. `undefined` when neither. */
+/**
+* A row value: a literal, or a principal ref the token carries. `undefined`
+* when neither.
+*/
 function valueSql(value, ctx) {
 	if (isConditionRef(value)) {
 		if (value.ref === "principal.id") return ctx.dialect.user;
@@ -479,7 +510,10 @@ function conditionSql(condition, table, ctx) {
 		default: return condition;
 	}
 }
-/** One `IN (SELECT …)` per role source of the membership table: the row's `left` is an instance the user holds `roles` in. */
+/**
+* One `IN (SELECT …)` per role source of the membership table: the row's `left`
+* is an instance the user holds `roles` in.
+*/
 function membershipIn(table, idColumn, left, roles, ctx) {
 	if (table.expiresAt !== void 0 || table.disabledAt !== void 0) return;
 	const name = bare(table.table, ctx.dialect);
@@ -504,7 +538,10 @@ function membershipIn(table, idColumn, left, roles, ctx) {
 		return [`${left} IN (SELECT ${ctx.dialect.column(name, idColumn)} FROM ${fromTable(table.table, ctx.dialect)} INNER JOIN ${fromTable(source.through, ctx.dialect)} ON ${ctx.dialect.column(keys, id)} = ${ctx.dialect.column(name, ref)} WHERE ${[...filters, `${ctx.dialect.column(keys, source.column)} IN (${list})`].join(" AND ")})`];
 	});
 }
-/** The membership filter of scope `scope`: its `rls.memberships` table, else the union of its membership sources. */
+/**
+* The membership filter of scope `scope`: its `rls.memberships` table, else the
+* union of its membership sources.
+*/
 function membershipSql(scope, left, roles, ctx) {
 	const table = scopeMembershipTable(ctx.config.rls?.memberships, ctx.scopes, scope);
 	if (table !== void 0) {
@@ -522,7 +559,10 @@ function membershipSql(scope, left, roles, ctx) {
 		return sourceIn(stream, scope, left, roles, ctx);
 	});
 }
-/** Who the grant reaches, as alternatives of clauses; `undefined` when Sync Streams cannot express it. */
+/**
+* Who the grant reaches, as alternatives of clauses; `undefined` when Sync
+* Streams cannot express it.
+*/
 function accessSql(item, table, ctx) {
 	const { access } = item;
 	switch (access.kind) {
@@ -547,7 +587,10 @@ function accessSql(item, table, ctx) {
 }
 /** A table outside `public` as `quotedTable` writes it. */
 const QUOTED_TABLE = /"(\w+)"\."(\w+)"/gu;
-/** `permdock_<table>`; a table in the `permdock` schema, `permdock_<table>` already, keeps one prefix. */
+/**
+* `permdock_<table>`; a table in the `permdock` schema, `permdock_<table>`
+* already, keeps one prefix.
+*/
 function subjectStreamName(table) {
 	return table.startsWith("permdock_") ? table : `permdock_${table}`;
 }
@@ -555,9 +598,8 @@ function roleThroughs(role) {
 	return (Array.isArray(role) ? role : [role]).filter((item) => typeof item === "object" && item !== null && "through" in item);
 }
 /**
-* The `SELECT`s of the root-scope ids the user is a member of: the root
-* scope's `rls.memberships` table, else each of its sources that can filter a
-* stream.
+* The `SELECT`s of the root-scope ids the user is a member of: the root scope's
+* `rls.memberships` table, else each of its sources that can filter a stream.
 */
 function userTenantIds(ctx) {
 	const { dialect } = ctx;
@@ -576,7 +618,10 @@ function userTenantIds(ctx) {
 		return [`SELECT ${dialect.column(rows.table, stream.id)} FROM ${rows.from} WHERE ${rows.where.join(" AND ")}`];
 	});
 }
-/** The stream forms of the sources of every scope `rls.memberships` maps no table for. */
+/**
+* The stream forms of the sources of every scope `rls.memberships` maps no
+* table for.
+*/
 function unmappedStreams(ctx) {
 	const out = /* @__PURE__ */ new Set();
 	for (const scope of ctx.scopes) {
@@ -586,10 +631,10 @@ function unmappedStreams(ctx) {
 	return [...out];
 }
 /**
-* Streams of the rows a device builds the user's snapshot from: the user's
-* own membership and global-role rows, the roles tables they reference, and
-* the custom roles of the user's tenants. Each query starts from the user's
-* own rows.
+* Streams of the rows a device builds the user's snapshot from: the user's own
+* membership and global-role rows, the roles tables they reference, and the
+* custom roles of the user's tenants. Each query starts from the user's own
+* rows.
 */
 function subjectStreams(ctx) {
 	const rls = ctx.config.rls;
@@ -618,12 +663,7 @@ function subjectStreams(ctx) {
 		}
 	};
 	const memberships = rls?.memberships;
-	for (const table of [
-		...Object.values(memberships?.scopes ?? {}),
-		...memberships?.tenant === void 0 ? [] : [memberships.tenant],
-		...memberships?.team === void 0 ? [] : [memberships.team],
-		...Object.values(memberships?.resource ?? {})
-	]) own(table.table, table.user, table.role);
+	for (const table of [...Object.values(memberships?.scopes ?? {}), ...Object.values(memberships?.resource ?? {})]) own(table.table, table.user, table.role);
 	for (const stream of unmappedStreams(ctx)) {
 		const rows = ownRows(stream, dialect);
 		add(rows.table, typeof stream.user === "string" ? `SELECT * FROM ${rows.from} WHERE ${rows.where.join(" AND ")}` : `SELECT ${rows.table}.* FROM ${rows.from} WHERE ${rows.where.join(" AND ")}`, typeof stream.user === "string" ? stream.user : void 0);
@@ -668,7 +708,10 @@ function subjectStreams(ctx) {
 	}
 	return out;
 }
-/** The membership sources as `rls generate` reads them: a tenant row of the custom roles table named like a declared role is no role. */
+/**
+* The membership sources as `rls generate` reads them: a tenant row of the
+* custom roles table named like a declared role is no role.
+*/
 function guardedSources(policy, config) {
 	const roles = config.rls?.customRoleWrites?.roles;
 	const guard = roles?.tenant === void 0 ? void 0 : {
@@ -692,8 +735,8 @@ function unsupported(item) {
 /**
 * Sync Streams for each synced resource: the union of the rows its read
 * permission's allow grants reach. A grant with any part Sync Streams cannot
-* express syncs nothing, and a resource with a deny grant gets no stream, so
-* a stream never holds a row the policy denies.
+* express syncs nothing, and a resource with a deny grant gets no stream, so a
+* stream never holds a row the policy denies.
 */
 function powersyncPlan(policy, config, dialect = POWERSYNC) {
 	const seen = /* @__PURE__ */ new Set();
@@ -819,11 +862,17 @@ function planWith(policy, config, dialect) {
 		...outside.length === 0 ? {} : { publication: `alter publication powersync add table ${outside.join(", ")};` }
 	};
 }
-/** A YAML scalar quoted as oxfmt and Prettier write it: single quotes around a `"`, unless a backslash needs a double-quoted escape. */
+/**
+* A YAML scalar quoted as oxfmt and Prettier write it: single quotes around a
+* `"`, unless a backslash needs a double-quoted escape.
+*/
 function yamlString(text) {
 	return text.includes("\"") && !text.includes("\\") ? `'${text.replaceAll("'", "''")}'` : JSON.stringify(text);
 }
-/** `sync-config.yaml`: edition 3 Sync Streams, one auto-subscribed stream per synced resource. */
+/**
+* `sync-config.yaml`: edition 3 Sync Streams, one auto-subscribed stream per
+* synced resource.
+*/
 function powersyncYaml(plan) {
 	const lines = [
 		"# Generated by permdock powersync generate from the policy. Do not edit.",
@@ -905,7 +954,10 @@ function powersyncFiles(policy, config, out) {
 		...plan.publication === void 0 ? {} : { publication: plan.publication }
 	};
 }
-/** The files whose content on disk is not what the policy compiles to, with `missing` for an absent one. */
+/**
+* The files whose content on disk is not what the policy compiles to, with
+* `missing` for an absent one.
+*/
 function staleFiles(cwd, files) {
 	const stale = [];
 	for (const file of files) {
@@ -929,7 +981,10 @@ async function leaks(query, stream, user, fixture) {
 	for (const text of stream.queries) if ((await query(`select 1 from (${text}) q where q.${quoteIdent(user)}::text is distinct from $1::text and $2::jsonb is not null limit 1`, [fixture.subject.id, claimsJson(fixture)])).length > 0) return true;
 	return false;
 }
-/** Whether the stream holds the fixture's row for its subject; `undefined` for a row with no id. */
+/**
+* Whether the stream holds the fixture's row for its subject; `undefined` for a
+* row with no id.
+*/
 async function synced(query, stream, fixture) {
 	const value = rowValue(fixture.row, stream.id);
 	if (value === void 0) return;
@@ -979,7 +1034,10 @@ async function verifyStreams(input) {
 		notes
 	};
 }
-/** PD058 when the `powersync` publication leaves out a synced table outside `public`; a note when the database has no such publication. */
+/**
+* PD058 when the `powersync` publication leaves out a synced table outside
+* `public`; a note when the database has no such publication.
+*/
 async function checkPublication(query, plan, mismatches, notes) {
 	if (plan.outside.length === 0) return;
 	if ((await query("select 1 from pg_catalog.pg_publication where pubname = 'powersync'", [])).length === 0) {

package/dist/{powersync-13odBwiM.js → powersync-DXqGuq9A.js}

@@ -1,5 +1,5 @@
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { c as given, d as policyFlag, n as dbUrl, o as fileOut, r as dbUrlFlags, t as checkFlag } from "./flags-aaeRAdiD.js";
+import { c as given, d as policyFlag, n as dbUrl, o as fileOut, r as dbUrlFlags, t as checkFlag } from "./flags-DXjoTVbS.js";
 //#region src/cli/commands/powersync.ts
 const generate = defineLeaf({
 	flags: {
@@ -14,7 +14,7 @@ const generate = defineLeaf({
 	async run(ctx, { flags }) {
 		const out = fileOut("powersync", flags.out);
 		const from = given(flags.policy);
-		const { runPowerSync } = await import("./powersync-CExtTLyA.js");
+		const { runPowerSync } = await import("./powersync-Djf-zCpB.js");
 		return runPowerSync({
 			cwd: ctx.cwd,
 			config: ctx.config,
@@ -45,7 +45,7 @@ const verify = defineLeaf({
 		const db = await dbUrl(ctx, flags, { required: true });
 		const fixtures = given(flags.fixtures);
 		const from = given(flags.policy);
-		const { runPowerSync } = await import("./powersync-CExtTLyA.js");
+		const { runPowerSync } = await import("./powersync-Djf-zCpB.js");
 		return runPowerSync({
 			cwd: ctx.cwd,
 			config: ctx.config,

package/dist/powersync-Djf-zCpB.js

@@ -0,0 +1 @@
+export { n as runPowerSync } from "./powersync-DHNQX06W.js";

package/dist/preset/index.d.ts

@@ -1,9 +1,8 @@
 //#region src/preset/catalog.d.ts
 /**
- * The preset catalogue: every choice `/create` and `permdock init` offer.
- * Each list is append-only and its order is part of the preset code
- * (`codec.ts`): a new choice goes at the end, and a removed one keeps its
- * slot as `retired`.
+ * The preset catalogue: every choice `/create` and `permdock init` offer. Each
+ * list is append-only and its order is part of the preset code (`codec.ts`): a
+ * new choice goes at the end, and a removed one keeps its slot as `retired`.
  */
 type ArchetypeId = "b2b" | "agent" | "marketplace" | "api" | "internal" | "consumer";
 type FeatureId = "tenancy" | "custom-roles" | "approvals" | "operations" | "decision-log" | "limits" | "plans" | "ownership" | "api-keys" | "rls";
@@ -33,13 +32,16 @@ export declare const AUTH: readonly Choice<AuthId>[];
 export declare const BACKENDS: readonly Choice<BackendId>[];
 export declare const FRAMEWORKS: readonly Choice<FrameworkId>[];
 /**
- * Agent runtimes and UI recipes. The preset code keeps one bitset per
- * `kind`, each in this list's order, so a new entry goes after the last
- * one of its kind.
+ * Agent runtimes and UI recipes. The preset code keeps one bitset per `kind`,
+ * each in this list's order, so a new entry goes after the last one of its
+ * kind.
  */
 export declare const INTEGRATIONS: readonly Integration[];
 export declare const SERVICES: readonly Choice<ServiceId>[];
-/** A complete preset: every choice `/create` and `permdock init` offer, resolved. */
+/**
+ * A complete preset: every choice `/create` and `permdock init` offer,
+ * resolved.
+ */
 type Preset = {
   readonly archetype: ArchetypeId;
   readonly features: readonly FeatureId[];
@@ -49,7 +51,10 @@ type Preset = {
   readonly integrations: readonly IntegrationId[];
   readonly services: readonly ServiceId[];
 };
-/** What a person picks; `resolvePreset` fills in the rest from `PRESET_DEFAULTS`. */
+/**
+ * What a person picks; `resolvePreset` fills in the rest from
+ * `PRESET_DEFAULTS`.
+ */
 type PresetInput = Partial<Preset> & {
   readonly archetype: ArchetypeId;
 };
@@ -58,10 +63,9 @@ export declare const PRESET_DEFAULTS: Preset;
 /** The integrations of one `kind` in `preset`, in catalogue order. */
 export declare function integrationsOf(preset: Pick<Preset, "integrations">, kind: IntegrationKind): IntegrationId[];
 /**
- * The preset `input` describes, with every feature its archetype,
- * integrations and other features require turned on, and lists in
- * catalogue order. Features are only ever added, so resolving twice is a
- * no-op.
+ * The preset `input` describes, with every feature its archetype, integrations
+ * and other features require turned on, and lists in catalogue order. Features
+ * are only ever added, so resolving twice is a no-op.
  */
 export declare function resolvePreset(input: PresetInput): Preset;
 //#endregion
@@ -69,22 +73,25 @@ export declare function resolvePreset(input: PresetInput): Preset;
 /** The preset code for `preset`, such as `p1AQIDBAc`. */
 export declare function encodePreset(preset: Preset): string;
 /**
- * The preset a code stands for, resolved, or `undefined` for a code that
- * is not a version this package reads or does not decode.
+ * The preset a code stands for, resolved, or `undefined` for a code that is not
+ * a version this package reads or does not decode.
  */
 export declare function decodePreset(code: string): Preset | undefined;
 //#endregion
 //#region src/preset/flags.d.ts
-/** One `permdock init` flag per preset key, with the catalogue it takes values from. */
+/**
+ * One `permdock init` flag per preset key, with the catalogue it takes values
+ * from.
+ */
 export declare const PRESET_FLAGS: { readonly [K in keyof Preset]: {
   readonly flag: string;
   readonly choices: readonly Choice<string>[];
   readonly repeatable: boolean;
 }; };
 /**
- * The `permdock init` flags that select `preset`, leaving out defaults and
- * the features its archetype and integrations already turn on, so
- * `permdock init <flags>` resolves to the same preset.
+ * The `permdock init` flags that select `preset`, leaving out defaults and the
+ * features its archetype and integrations already turn on, so `permdock init
+ * <flags>` resolves to the same preset.
  */
 export declare function presetFlags(preset: Preset): string[];
 //#endregion
@@ -94,9 +101,9 @@ type GeneratedFile = {
   readonly path: string;
   readonly contents: string;
   /**
-   * `owned`: the application's own code, edited freely and never
-   * rewritten by an update. Every generated file is owned; rules, checks and
-   * verification stay in the `permdock` package, which these files only call.
+   * `owned`: the application's own code, edited freely and never rewritten by
+   * an update. Every generated file is owned; rules, checks and verification
+   * stay in the `permdock` package, which these files only call.
    */
   readonly kind: "owned";
 };
@@ -113,9 +120,9 @@ type GeneratedPreset = {
   readonly docs: readonly string[];
 };
 /**
- * The files, dependencies and recipes for `preset`. Pure: no file system
- * and no network, so the same function runs in the CLI, in a registry route
- * and in the browser preview on /create.
+ * The files, dependencies and recipes for `preset`. Pure: no file system and no
+ * network, so the same function runs in the CLI, in a registry route and in the
+ * browser preview on /create.
  */
 export declare function generatePreset(preset: Preset, options?: {
   readonly src?: string;
@@ -124,7 +131,10 @@ export declare function generatePreset(preset: Preset, options?: {
 //#region src/preset/matrix.d.ts
 /** How one role reaches one action under a preset. */
 type MatrixAccess = {
-  /** `allow`: always; `own`: on rows it owns; `pro`: on the pro plan; `none`: never. */
+  /**
+   * `allow`: always; `own`: on rows it owns; `pro`: on the pro plan; `none`:
+   * never.
+   */
   readonly access: "allow" | "own" | "pro" | "none";
   readonly approval: boolean;
   readonly limit: boolean;
@@ -138,8 +148,8 @@ type PresetMatrix = {
   }[];
 };
 /**
- * Who may do what under `preset`, from the same model the generated policy
- * is written from, for a page that shows the policy without running it.
+ * Who may do what under `preset`, from the same model the generated policy is
+ * written from, for a page that shows the policy without running it.
  */
 export declare function presetMatrix(preset: Preset): PresetMatrix;
 //#endregion

package/dist/preset/index.js

@@ -1 +1 @@
-export { s as ARCHETYPES, c as AUTH, l as BACKENDS, u as FEATURES, d as FRAMEWORKS, f as INTEGRATIONS, p as PRESET_DEFAULTS, r as PRESET_FLAGS, m as SERVICES, a as decodePreset, o as encodePreset, n as generatePreset, h as integrationsOf, i as presetFlags, t as presetMatrix, g as resolvePreset } from "../preset-CHTbd-DQ.js";
+export { s as ARCHETYPES, c as AUTH, l as BACKENDS, u as FEATURES, d as FRAMEWORKS, f as INTEGRATIONS, p as PRESET_DEFAULTS, r as PRESET_FLAGS, m as SERVICES, a as decodePreset, o as encodePreset, n as generatePreset, h as integrationsOf, i as presetFlags, t as presetMatrix, g as resolvePreset } from "../preset-BjLzeFpp.js";