permdock 0.7.0 → 0.8.0

package/dist/policies-B2lZIurj.js

@@ -1,295 +0,0 @@
-import { a as sole } from "./compact-CAf557ZB.js";
-import { i as configError, n as CliError } from "./errors-DpP_U6Bf.js";
-import { i as requirePeer } from "./peer-12Q5I_RH.js";
-import { D as qualified, _ as subjectClaimJsonSql } from "./shared-fMKOv8hP.js";
-//#region src/cli/pg.ts
-const CONNECT_TIMEOUT_MS = 1e4;
-const STATEMENT_TIMEOUT_MS = 6e4;
-function loadPg(command, cwd) {
-	return requirePeer(() => import("pg"), "pg", command, cwd);
-}
-function options(db) {
-	return {
-		connectionString: db,
-		connectionTimeoutMillis: CONNECT_TIMEOUT_MS,
-		statement_timeout: STATEMENT_TIMEOUT_MS
-	};
-}
-function unreachable(command, cause) {
-	return new CliError("unavailable", `PermDock CLI: ${command.replace(/^permdock /u, "")} could not connect`, {
-		cause,
-		code: "database_unreachable"
-	});
-}
-/** The default `connect` of a command: one connection, failing with a message that names `command`. */
-function pgConnector(command, cwd = process.cwd()) {
-	return (db) => connectPg(db, command, cwd);
-}
-/** One connection, for commands that run a transaction. */
-async function connectPg(db, command, cwd) {
-	const client = new (await (loadPg(command, cwd))).Client(options(db));
-	try {
-		await client.connect();
-	} catch (cause) {
-		throw unreachable(command, cause);
-	}
-	return {
-		query: (sql, values) => client.query(sql, values),
-		end: () => client.end()
-	};
-}
-/** A small pool, for independent catalog reads that can run in parallel. */
-async function connectPgPool(db, command, cwd = process.cwd()) {
-	const pool = new (await (loadPg(command, cwd))).Pool({
-		...options(db),
-		max: 4
-	});
-	try {
-		(await pool.connect()).release();
-	} catch (cause) {
-		await pool.end();
-		throw unreachable(command, cause);
-	}
-	return {
-		query: (sql, values) => pool.query(sql, values),
-		end: () => pool.end()
-	};
-}
-//#endregion
-//#region src/cli/sql/clauses.ts
-/** True when `sql` is one parenthesised expression, so AND / OR need not wrap it again. */
-function isWrapped(sql) {
-	if (!sql.startsWith("(") || !sql.endsWith(")")) return false;
-	let depth = 0;
-	let quoted = false;
-	for (let index = 0; index < sql.length; index += 1) {
-		const ch = sql[index];
-		if (ch === "'") quoted = !quoted;
-		else if (!quoted && ch === "(") depth += 1;
-		else if (!quoted && ch === ")") {
-			depth -= 1;
-			if (depth === 0 && index < sql.length - 1) return false;
-		}
-	}
-	return depth === 0;
-}
-function wrapSql(sql) {
-	return isWrapped(sql) ? sql : `(${sql})`;
-}
-/**
-* The grant's `validFrom` / `validUntil` as a clock check: `from` inclusive,
-* `until` exclusive, matching the in-process evaluator.
-*/
-function validitySql(validity) {
-	if (validity === void 0) return;
-	return andSql(validity.from === void 0 ? void 0 : `now() >= to_timestamp(${validity.from})`, validity.until === void 0 ? void 0 : `now() < to_timestamp(${validity.until})`);
-}
-function andSql(...parts) {
-	const present = parts.filter((part) => part !== void 0 && part !== "true");
-	if (present.length === 0) return;
-	return present.length === 1 ? present[0] : present.map(wrapSql).join(" and ");
-}
-/** `USING` and `WITH CHECK` for a branch: its access check ANDed with its row conditions. */
-function branchClauses(branch) {
-	const using = branch.command === "insert" ? void 0 : andSql(branch.access, branch.using) ?? "true";
-	const check = branch.command === "insert" || branch.command === "update" ? andSql(branch.access, branch.check) ?? "true" : void 0;
-	return {
-		...using === void 0 ? {} : { using },
-		...check === void 0 ? {} : { check }
-	};
-}
-//#endregion
-//#region src/cli/rls/policies.ts
-/** Each database role gets its own policy, so no role sees two permissive policies for one command. */
-const AUDIENCES = ["authenticated", "anon"];
-const DEFAULT_POLICY_NAME = "{table}_{op}";
-const DEFAULT_PER_ROLE_NAME = "{role}_{permission}";
-const PLACEHOLDER = /\{(table|op|role|permission)\}/gu;
-function sanitize(name) {
-	return name.replaceAll(/[^A-Za-z0-9_]/g, "_");
-}
-function render(template, values) {
-	return sanitize(template.replaceAll(PLACEHOLDER, (_match, key) => values[key]));
-}
-/** Rejects a template that cannot name every policy of the chosen shape uniquely. */
-function assertPolicyName(template, perRole) {
-	if (!perRole && /\{(role|permission)\}/u.test(template)) throw configError("PermDock CLI: --policy-name {role} and {permission} need --policy-per-role; a collapsed policy covers several roles");
-	if (!perRole && !(template.includes("{table}") && template.includes("{op}"))) throw configError("PermDock CLI: --policy-name needs {table} and {op} so each table and command gets its own policy");
-}
-function orSql(parts) {
-	const distinct = [...new Set(parts)];
-	if (distinct.includes("true")) return "true";
-	return sole(distinct) ?? distinct.map(wrapSql).join(" or ");
-}
-function negate(sql) {
-	return sql === void 0 ? void 0 : `(${sql}) is not true`;
-}
-function policyOf(name, branch, using, check) {
-	const deny = branch.effect === "deny";
-	const policy = {
-		name,
-		table: branch.table,
-		command: branch.command,
-		effect: branch.effect,
-		roles: branch.roles
-	};
-	const finalUsing = deny ? negate(using) : using;
-	const finalCheck = deny ? negate(check) : check;
-	if (finalUsing !== void 0) policy.using = finalUsing;
-	if (finalCheck !== void 0) policy.check = finalCheck;
-	return policy;
-}
-function uniqueName(names, name) {
-	const seen = names.get(name) ?? 0;
-	names.set(name, seen + 1);
-	return seen === 0 ? name : `${name}_${seen + 1}`;
-}
-function perRolePolicies(branches, template) {
-	const names = /* @__PURE__ */ new Map();
-	return branches.map((branch) => {
-		const clauses = branchClauses(branch);
-		const deny = branch.effect === "deny";
-		const base = render(template, {
-			table: branch.table,
-			op: branch.command,
-			role: branch.label,
-			permission: branch.permissionKey
-		});
-		const name = `${deny ? "deny_" : ""}${base}${branch.coverage === true ? "_select_coverage" : ""}`;
-		return policyOf(uniqueName(names, name), branch, clauses.using, clauses.check);
-	});
-}
-/**
-* Branches of one grant-key group share their row condition, so the group
-* becomes one OR branch whose access ORs the helper calls of each scope.
-*/
-function mergeGroups(branches) {
-	const merged = [];
-	const byKey = /* @__PURE__ */ new Map();
-	for (const branch of branches) {
-		const id = branch.grantKey === void 0 ? void 0 : `${branch.table}\u0000${branch.command}\u0000${branch.grantKey}\u0000${branch.coverage === true}`;
-		const entry = id === void 0 ? void 0 : byKey.get(id);
-		if (entry === void 0) {
-			const created = {
-				branch,
-				accesses: branch.access === void 0 ? [] : [branch.access]
-			};
-			if (id !== void 0) byKey.set(id, created);
-			merged.push(created);
-			continue;
-		}
-		if (branch.access !== void 0 && !entry.accesses.includes(branch.access)) entry.accesses.push(branch.access);
-	}
-	return merged.map(({ branch, accesses }) => accesses.length <= 1 ? branch : withAccess(branch, orSql(accesses)));
-}
-function withAccess(branch, access) {
-	return {
-		...branch,
-		access
-	};
-}
-function collapsedPolicies(branches, template) {
-	const groups = /* @__PURE__ */ new Map();
-	for (const branch of mergeGroups(branches)) {
-		const id = `${branch.table}\u0000${branch.command}\u0000${branch.effect}`;
-		groups.set(id, [...groups.get(id) ?? [], branch]);
-	}
-	const names = /* @__PURE__ */ new Map();
-	return [...groups.values()].flatMap((group) => AUDIENCES.flatMap((audience) => {
-		const members = group.filter((branch) => branch.roles.includes(audience));
-		const [first] = members;
-		if (first === void 0) return [];
-		const deny = first.effect === "deny";
-		const clauses = members.map(branchClauses);
-		const usings = clauses.flatMap((item) => item.using === void 0 ? [] : [item.using]);
-		const checks = clauses.flatMap((item) => item.check === void 0 ? [] : [item.check]);
-		const base = render(template, {
-			table: first.table,
-			op: first.command,
-			role: first.label,
-			permission: first.permissionKey
-		});
-		return [policyOf(uniqueName(names, `${deny ? "deny_" : ""}${base}${audience === "anon" ? "_anon" : ""}`), {
-			...first,
-			roles: [audience]
-		}, usings.length === 0 ? void 0 : orSql(usings), checks.length === 0 ? void 0 : orSql(checks))];
-	}));
-}
-/**
-* Assembles policies. The default is one PERMISSIVE policy per table,
-* command and database role (Splinter `multiple_permissive_policies` stays
-* quiet), with denies in one RESTRICTIVE policy per table, command and role.
-*/
-function assemblePolicies(branches, shape) {
-	const template = shape.name ?? (shape.perRole ? DEFAULT_PER_ROLE_NAME : DEFAULT_POLICY_NAME);
-	assertPolicyName(template, shape.perRole);
-	return shape.perRole ? perRolePolicies(branches, template) : collapsedPolicies(branches, template);
-}
-const DEFAULT_READ_ONLY_ACTORS = ["support", "impersonation"];
-const ACTOR_KIND = /^[a-z][a-z0-9_-]*$/u;
-/** The actor kinds `rls.readOnlyActors` names, or `undefined` when it is off. */
-function readOnlyActorKinds(setting) {
-	if (setting === void 0 || setting === false) return;
-	const kinds = setting === true ? DEFAULT_READ_ONLY_ACTORS : setting;
-	if (kinds.length === 0 || kinds.some((kind) => !ACTOR_KIND.test(kind))) throw configError("PermDock CLI: rls.readOnlyActors must be true or a non-empty list of actor kinds such as 'support'");
-	return [...new Set(kinds)];
-}
-/** `permdock_actor_may_write()`, for hand-written write policies. Names are part of the SQL contract. */
-const ACTOR_MAY_WRITE = "permdock_actor_may_write";
-/**
-* True unless the token's `act` claim (`act`, as SQL `jsonb`) is a session
-* of one of `kinds` that is not `read_only: false`, or an agent with
-* `read_only: true` (agents default to writable, as better-supabase reads them).
-*/
-function readOnlyActorPasses(act, kinds) {
-	const list = `array[${kinds.map((kind) => `'${kind}'`).join(", ")}]::text[]`;
-	const passes = `(not coalesce(${kinds.includes("support") ? `(${act} ->> 'kind') = any(${list}) or ((${act} ->> 'kind') is null and ${act} ? 'session_id')` : `(${act} ->> 'kind') = any(${list})`}, false) or coalesce((${act} ->> 'read_only') = 'false', false))`;
-	return kinds.includes("agent") ? passes : `${passes} and not coalesce((${act} ->> 'kind') = 'agent' and (${act} ->> 'read_only') = 'true', false)`;
-}
-/**
-* `permdock_actor_may_write()`: {@link readOnlyActorPasses} as a function, so
-* hand-written write policies apply the same read-only default.
-*/
-function actorMayWriteSql(ctx, kinds) {
-	const fn = qualified(ctx, ACTOR_MAY_WRITE);
-	return `-- rls.readOnlyActors: false for a token whose act claim is a read-only ${kinds.join(" or ")} session; hand-written write policies call it
-create or replace function ${fn}()
-returns boolean
-language sql
-stable
-set search_path = ''
-as $$
-  select ${readOnlyActorPasses(subjectClaimJsonSql(ctx, "act"), kinds)}
-$$;
-revoke execute on function ${fn}() from public, anon;
-grant execute on function ${fn}() to authenticated;
-`;
-}
-/**
-* One restrictive policy per table and write command the allow policies
-* grant to `authenticated`: the write passes unless the token's `act` claim
-* (`act`, as SQL `jsonb`) is a session of one of `kinds` that is not
-* `read_only: false`. Reads are never touched.
-*/
-function readOnlyActorPolicies(policies, act, kinds) {
-	const passes = readOnlyActorPasses(act, kinds);
-	const seen = /* @__PURE__ */ new Set();
-	const out = [];
-	for (const policy of policies) {
-		const key = `${policy.table}\u0000${policy.command}`;
-		if (policy.effect !== "allow" || policy.command === "select" || !policy.roles.includes("authenticated") || seen.has(key)) continue;
-		seen.add(key);
-		out.push({
-			name: sanitize(`${policy.table}_${policy.command}_read_only_actors`),
-			table: policy.table,
-			command: policy.command,
-			effect: "deny",
-			roles: ["authenticated"],
-			...policy.command === "insert" ? {} : { using: passes },
-			...policy.command === "delete" ? {} : { check: passes }
-		});
-	}
-	return out;
-}
-//#endregion
-export { readOnlyActorKinds as a, branchClauses as c, connectPgPool as d, pgConnector as f, orSql as i, validitySql as l, actorMayWriteSql as n, readOnlyActorPolicies as o, assemblePolicies as r, andSql as s, ACTOR_MAY_WRITE as t, wrapSql as u };

package/dist/powersync-CExtTLyA.js

@@ -1 +0,0 @@
-export { n as runPowerSync } from "./powersync-53ryOZip.js";

package/dist/problem-details-Tcfmj3bV.d.ts

@@ -1,7 +0,0 @@
-import { Ln as Decision } from "./policy-types-B-F-qAZk.js";
-//#region src/core/problem-details.d.ts
-type Disclosure = "hide" | "reveal";
-/** The plans a `not-entitled` denial asks for; empty unless every denial is `not-entitled`. */
-declare function requiredPlans(decision: Decision): readonly string[];
-//#endregion
-export { requiredPlans as n, Disclosure as t };

package/dist/protected-BwZYL1X_.d.ts

@@ -1,39 +0,0 @@
-import { Ln as Decision, j as PolicyVocabulary, or as Membership } from "./policy-types-B-F-qAZk.js";
-import { u as Permission } from "./permission-types-DhNEmoRG.js";
-import { r as Role } from "./vocabulary-Bg3eeT2H.js";
-import { r as DescribeOptions, t as DecisionDescription } from "./describe-O0SwYIK8.js";
-import { a as FilterResult, c as PermissionSet, d as RolesOptions, f as SubjectView, l as PermissionState, o as GateMode, p as TenantView, r as ClientPermDock, s as GateView, t as ApprovalHandle } from "./types-CKV71kKh.js";
-import { r as ProtectedProps } from "./types-CQVEQawv.js";
-import { ReactNode } from "react";
-//#region src/react/hooks.d.ts
-declare function usePermDock<V extends PolicyVocabulary = PolicyVocabulary>(): ClientPermDock<V>;
-declare function usePermission(permission: Permission, data?: unknown): PermissionState;
-declare function usePermissions(permissions: readonly Permission[], data?: unknown): PermissionSet;
-declare function useFilter<T>(permission: Permission<string, T, "instance">, rows: readonly T[]): FilterResult<T>;
-declare function useTenant(): TenantView;
-declare function useMemberships(): readonly Membership[];
-declare function useRoles(options?: RolesOptions): {
-  readonly roles: readonly Role[];
-};
-declare function useAssignableRoles(): readonly Role[];
-declare function useAssignablePermissions(options?: {
-  readonly tenant?: string;
-}): readonly Permission[];
-declare function useSubject(): SubjectView;
-/** `describe` with the provider's `messages`; a call's own `messages` win. */
-declare function useDescribe(): (decision: Decision, options?: DescribeOptions) => DecisionDescription;
-declare function useApproval(decision: Decision): ApprovalHandle;
-/**
- * What a permission-gated control renders: `hidden`, `disabled`,
- * `needsApproval`, `upgrade` and a localised `reason`, from the same
- * snapshot as `usePermission`. React and React Native share it; a recipe
- * renders the fields and decides nothing.
- */
-declare function useGate(permission: Permission, data?: unknown, options?: {
-  readonly mode?: GateMode;
-}): GateView;
-//#endregion
-//#region src/react/protected.d.ts
-declare function Protected(props: ProtectedProps): ReactNode;
-//#endregion
-export { useDescribe as a, useMemberships as c, usePermissions as d, useRoles as f, useAssignableRoles as i, usePermDock as l, useTenant as m, useApproval as n, useFilter as o, useSubject as p, useAssignablePermissions as r, useGate as s, Protected as t, usePermission as u };

package/dist/pull-Cty6Ovyu.js

@@ -1 +0,0 @@
-export { n as runCloudPull } from "./pull-CN5OLxrF.js";

package/dist/run-Bz7DXGEv.js

@@ -1 +0,0 @@
-export { t as run } from "./run-uLD2aWuO.js";

package/dist/stores-BAZwSYZA.d.ts

@@ -1,31 +0,0 @@
-import { Ln as Decision, or as Membership } from "./policy-types-B-F-qAZk.js";
-import { u as Permission } from "./permission-types-DhNEmoRG.js";
-import { r as Role } from "./vocabulary-Bg3eeT2H.js";
-import { r as DescribeOptions, t as DecisionDescription } from "./describe-O0SwYIK8.js";
-import { a as FilterResult, c as PermissionSet, d as RolesOptions, f as SubjectView, l as PermissionState, p as TenantView, r as ClientPermDock, t as ApprovalHandle } from "./types-CKV71kKh.js";
-import { n as SveltePermDockOptions } from "./types-DXmwu78Z.js";
-import { Readable } from "svelte/store";
-//#region src/svelte/stores.d.ts
-declare function setPermDock(options: SveltePermDockOptions): ClientPermDock;
-declare function getPermDock(): ClientPermDock;
-/** `describe` with the provider's `messages`; a call's own `messages` win. Call it during component init. */
-declare function getDescribe(): (decision: Decision, options?: DescribeOptions) => DecisionDescription;
-declare function permission(reference: Permission, data?: () => unknown): Readable<PermissionState>;
-declare function permissions(references: () => readonly Permission[], data?: () => unknown): Readable<PermissionSet>;
-declare function filtered<T>(reference: Permission<string, T, "instance">, rows: () => readonly T[]): Readable<FilterResult<T>>;
-declare function tenant(): Readable<TenantView>;
-declare function memberships(): Readable<readonly Membership[]>;
-declare function roles(options?: () => RolesOptions): Readable<{
-  readonly roles: readonly Role[];
-}>;
-declare function assignable(): Readable<readonly Role[]>;
-type AssignableOptions = {
-  readonly tenant?: string;
-} | (() => {
-  readonly tenant?: string;
-});
-declare function assignablePermissions(options?: AssignableOptions): Readable<readonly Permission[]>;
-declare function subject(): Readable<SubjectView>;
-declare function approval(decision: () => Decision): Readable<ApprovalHandle>;
-//#endregion
-export { getDescribe as a, permission as c, setPermDock as d, subject as f, filtered as i, permissions as l, assignable as n, getPermDock as o, tenant as p, assignablePermissions as r, memberships as s, approval as t, roles as u };

package/dist/supabase-hook-DJxC4PoP.js

@@ -1 +0,0 @@
-export { i as runSupabase } from "./supabase-hook-Dg0SrQWR.js";

package/dist/types-CKV71kKh.d.ts

@@ -1,172 +0,0 @@
-import { Gt as Snapshot, Ln as Decision, Zn as Actor, dt as TokenVerifier, j as PolicyVocabulary, rr as Delegation, sr as Principal } from "./policy-types-B-F-qAZk.js";
-import { u as Permission } from "./permission-types-DhNEmoRG.js";
-import { a as PermDock } from "./permdock-Dco6dyCK.js";
-import { n as DescribeMessages, t as DecisionDescription } from "./describe-O0SwYIK8.js";
-//#region src/client/request.d.ts
-type StoreHeaders = Readonly<Record<string, string>>;
-//#endregion
-//#region src/client/store.d.ts
-type ClientStoreOptions = {
-  readonly snapshot: Snapshot | string;
-  readonly endpoint?: string;
-  readonly snapshotUrl?: string;
-  readonly approvals?: string;
-  readonly tenant?: string;
-  readonly fetch?: typeof fetch;
-  /** Request headers, or a getter read on every request so a rotated token needs no new store. */
-  readonly headers?: StoreHeaders | (() => StoreHeaders | undefined);
-  readonly maxAge?: number;
-  readonly verifier?: TokenVerifier;
-  /** `raw` is the compact JWS the snapshot was verified from, so a signed snapshot can be persisted signed. */
-  readonly onSnapshot?: (snapshot: Snapshot, tenant: string | undefined, raw: string | undefined) => void;
-  readonly onClear?: () => void;
-  /** Called once per key the snapshot cannot answer when there is no `endpoint` to ask. */
-  readonly onServerOnly?: (permission: Permission) => void;
-  /**
-   * `true` while rendering on the server: endpoint checks answer `pending`
-   * without a request. Defaults to `typeof window === 'undefined'`.
-   */
-  readonly server?: boolean;
-  /** Milliseconds between approval status polls. Defaults to 2000. */
-  readonly approvalInterval?: number;
-  /** Start `pending`: the snapshot arrives later through `track()`. */
-  readonly awaiting?: boolean;
-  /**
-   * The first snapshot that hydrates with a principal is a persisted copy:
-   * `stale` until a refresh or a `replace()` lands.
-   */
-  readonly stale?: boolean;
-  /**
-   * Reuse decisions for the same row object until the next microtask. Only for
-   * renderers that do not track the fields a check reads (React): Vue, Svelte
-   * and Solid would stop re-running when a reactive row changes in place.
-   */
-  readonly passCache?: boolean;
-};
-type ClientStore = {
-  get(): ClientPermDock;
-  subscribe(listener: () => void): () => void;
-  permissionState(permission: Permission, data?: unknown): PermissionState;
-  requestApproval(decision: Decision, note?: string): Promise<void>;
-  /** Hydrate from a pushed snapshot; a compact JWS goes through the verifier. */
-  replace(value: unknown): void;
-  /** Stay `pending` until `value` settles, then hydrate; a rejection fails closed. */
-  follow(value: PromiseLike<Snapshot | string>): void;
-  /**
-   * `follow()` once per `value`, without suspending. A thenable React already
-   * settled (`status: 'fulfilled'`) hydrates at once.
-   */
-  track(value: PromiseLike<Snapshot | string>): void;
-  /**
-   * The approval state for a decision. While something subscribes, an
-   * `approval-required` decision is polled at `<approvals>/<token>`.
-   */
-  approvalState(decision: Decision): ApprovalState;
-  /**
-   * Hydrate from a resolved `snapshotPromise` during render. Idempotent per `source`;
-   * subscribers are notified in a microtask, never synchronously inside render.
-   */
-  adopt(value: Snapshot | string, source: object): void;
-  snapshot(): Snapshot;
-  /** The tenant the store currently answers for. */
-  tenant(): string | undefined;
-  /** Stops polls, drops in-flight results and persistence; the store keeps answering from its last snapshot. */
-  dispose(): void;
-};
-//#endregion
-//#region src/client/types.d.ts
-type ClientStatus = "ready" | "pending" | "stale" | "server-only";
-type PermissionState = {
-  readonly allowed: boolean;
-  readonly status: ClientStatus;
-  readonly decision: Decision;
-};
-type PermissionSet = {
-  readonly granted: readonly Permission[];
-  get(permission: Permission): PermissionState | undefined;
-};
-type ClientPermDock<V extends PolicyVocabulary = PolicyVocabulary> = PermDock<V> & {
-  status(permission?: Permission, data?: unknown): ClientStatus;
-  invalidate(ref: Permission | {
-    readonly [key: string]: unknown;
-  }): void;
-  refresh(options?: {
-    readonly tenant?: string;
-  }): Promise<void>;
-  clear(): void;
-  subscribe(listener: () => void): () => void;
-};
-type ApprovalState = "not-needed" | "required" | "pending" | "approved" | "rejected" | "expired";
-type ApprovalHandle = {
-  readonly state: ApprovalState;
-  readonly token: string | undefined;
-  readonly request: (note?: string) => Promise<void>;
-};
-type SubjectView = {
-  readonly principal: Principal | null;
-  readonly actor: Actor | undefined;
-  readonly delegation: Delegation | undefined;
-  readonly expiresAt: number | undefined;
-  readonly simulated: boolean;
-};
-type TenantView = {
-  readonly tenant: string | null;
-  readonly tenants: readonly string[];
-  readonly switchTo: (id: string) => Promise<void>;
-  readonly status: ClientStatus;
-};
-type FilterResult<T> = readonly T[] & {
-  readonly partial: boolean;
-};
-type RolesOptions = {
-  readonly tenant?: string;
-  readonly team?: string;
-};
-/** The provider options Vue, Svelte and Solid share; each adds its own reactive `snapshot`, `tenant`, `headers`, `verifier` and `defaults`. */
-type ProviderOptionsBase = {
-  /**
-   * The AuthZEN evaluations endpoint for checks the snapshot cannot answer.
-   * `false` never calls one: such a check is denied with reason `server-only`.
-   */
-  readonly endpoint?: string | false;
-  /** Where `refresh()` fetches a fresh snapshot. Defaults to `endpoint`. */
-  readonly snapshotUrl?: string;
-  readonly approvals?: string;
-  /** Read on every request, so a new `fetch` applies without a new store. */
-  readonly fetch?: typeof fetch;
-  readonly maxAge?: number;
-  /** Localised text for the describe helper. */
-  readonly messages?: DescribeMessages;
-  /** Called with each snapshot the store accepts. */
-  readonly onSnapshot?: NonNullable<ClientStoreOptions["onSnapshot"]>;
-  /** Called when the store drops its snapshot. */
-  readonly onClear?: () => void;
-  /** Milliseconds between approval status polls. Defaults to 2000. */
-  readonly approvalInterval?: number;
-};
-/** How a control shows a permission it cannot use: hidden, or disabled with a reason. */
-type GateMode = "hide" | "disable";
-/**
- * Everything a permission-gated control renders from, in one value: a
- * button, a menu item or a link reads these fields and decides nothing
- * itself. The client is a hint; the server checks again.
- */
-type GateView = {
-  /** The decision granted the action. */
-  readonly allowed: boolean;
-  /** The snapshot is loading; render the control disabled, not hidden. */
-  readonly pending: boolean;
-  /** `mode: "hide"` and the action is not available: render nothing. */
-  readonly hidden: boolean;
-  /** The control cannot run the action now (denied, pending or awaiting approval). */
-  readonly disabled: boolean;
-  /** The decision needs a person's approval first; offer to request it. */
-  readonly needsApproval: boolean;
-  /** The plans that would grant the action, for an upgrade prompt; empty otherwise. */
-  readonly upgrade: readonly string[];
-  /** Title and detail for a tooltip or an accessible description. */
-  readonly reason: DecisionDescription;
-  readonly decision: Decision;
-};
-//#endregion
-export { FilterResult as a, PermissionSet as c, RolesOptions as d, SubjectView as f, ClientStoreOptions as h, ClientStatus as i, PermissionState as l, ClientStore as m, ApprovalState as n, GateMode as o, TenantView as p, ClientPermDock as r, GateView as s, ApprovalHandle as t, ProviderOptionsBase as u };

package/dist/usage-y-kBNdqs.js

@@ -1 +0,0 @@
-export { t as runUsage } from "./usage-Bybmck7f.js";

package/dist/version-CEbQ5UeM.js

@@ -1,18 +0,0 @@
-import { t as packageRoot } from "./package-root-Dk_ETdkp.js";
-import { readFileSync } from "node:fs";
-import { join } from "node:path";
-//#region src/cli/core/version.ts
-function cliVersion() {
-	return JSON.parse(readFileSync(join(packageRoot(), "package.json"), "utf8")).version;
-}
-function generatorBanner() {
-	return `permdock@${cliVersion()}`;
-}
-const CATALOG_SCHEMA = "https://permdock.com/schemas/catalog-v1.json";
-const SUPABASE_MANIFEST_SCHEMA = "https://permdock.com/schemas/supabase-manifest-v1.json";
-const USAGE_REPORT_SCHEMA = "https://permdock.com/schemas/usage-report-v1.json";
-const DOCTOR_REPORT_SCHEMA = "https://permdock.com/schemas/doctor-report-v1.json";
-const CONFIG_REPORT_SCHEMA = "https://permdock.com/schemas/config-report-v1.json";
-const ARAZZO_REPORT_SCHEMA = "https://permdock.com/schemas/arazzo-report-v1.json";
-//#endregion
-export { SUPABASE_MANIFEST_SCHEMA as a, generatorBanner as c, DOCTOR_REPORT_SCHEMA as i, CATALOG_SCHEMA as n, USAGE_REPORT_SCHEMA as o, CONFIG_REPORT_SCHEMA as r, cliVersion as s, ARAZZO_REPORT_SCHEMA as t };

package/dist/version-DXkYUISx.js

@@ -1 +0,0 @@
-export { s as cliVersion } from "./version-CEbQ5UeM.js";

package/dist/watch-Bd9mx3rd.js

@@ -1 +0,0 @@
-export { i as watchCollect } from "./watch-C-4VmFlL.js";