permdock 0.7.0 → 0.9.0

package/dist/config-CoQHDrDi.js

@@ -1,166 +0,0 @@
-import { r as isRecord } from "./compact-CAf557ZB.js";
-import { n as CliError } from "./errors-DpP_U6Bf.js";
-import { existsSync } from "node:fs";
-import { relative, resolve } from "node:path";
-//#region src/cli/project/config-schema.ts
-const SECTIONS = {
-	collect: {
-		srcPath: true,
-		out: true,
-		barrel: true
-	},
-	catalog: { out: true },
-	openapi: { doc: true },
-	rls: {
-		tables: true,
-		dialect: true,
-		memberships: true,
-		membershipSources: true,
-		suspension: true,
-		functions: true,
-		inlineFunctions: true,
-		force: true,
-		fixtures: true,
-		verify: true,
-		tenantClaim: true,
-		tenantType: true,
-		teamType: true,
-		scopeTypes: true,
-		roleClaim: true,
-		roleValues: true,
-		gucPrefix: true,
-		out: true,
-		drizzle: true,
-		prisma: true,
-		schema: true,
-		authorize: true,
-		policyPerRole: true,
-		customRoles: true,
-		triggers: true,
-		audit: true,
-		capabilities: true,
-		anonymousSignIns: true,
-		fields: true,
-		revokeColumns: true,
-		policyName: true,
-		rbac: true,
-		roles: true,
-		actions: true,
-		helpersOnly: true,
-		rowHelpers: true,
-		seeds: true,
-		treeValues: true,
-		trustedReaders: true,
-		migrate: true,
-		shims: true,
-		tenants: true,
-		customRoleWrites: true,
-		anonExecute: true,
-		assignments: true,
-		approvals: true,
-		jsonSchema: true,
-		ownershipTriggers: true,
-		readOnlyActors: true,
-		apiKeys: true,
-		tokenScopes: true,
-		realtime: true,
-		storage: true
-	},
-	supabase: {
-		hook: true,
-		schemas: true
-	},
-	powersync: {
-		out: true,
-		resources: true,
-		action: true,
-		manifest: true
-	},
-	doctor: {
-		sensitiveActions: true,
-		memberships: true,
-		credentials: true,
-		clientEntries: true,
-		migrations: true,
-		claims: true,
-		srcPath: true,
-		sharedTables: true
-	}
-};
-const TOP_LEVEL = /* @__PURE__ */ new Set([
-	"permissions",
-	"policy",
-	"operations",
-	...Object.keys(SECTIONS)
-]);
-function isSection(key) {
-	return Object.hasOwn(SECTIONS, key);
-}
-/**
-* Checks the shape a command relies on before it reads the config: module
-* paths are strings and each section is an object. A key PermDock does not
-* read is a warning, so a config written for a newer version still loads.
-*/
-function parseConfig(value, file) {
-	if (value === void 0) return {
-		config: {},
-		warnings: []
-	};
-	if (!isRecord(value)) throw new CliError("usage", `PermDock CLI: ${file} must export a config object as default (use defineConfig)`);
-	const warnings = [];
-	const unknown = (path, known) => `${file}: unknown key ${path}; PermDock reads ${[...known].join(", ")}`;
-	for (const [key, entry] of Object.entries(value)) {
-		if (key === "permissions" || key === "policy" || key === "operations") {
-			if (entry !== void 0 && typeof entry !== "string") throw new CliError("usage", `PermDock CLI: ${file}: ${key} must be a module path string`);
-			continue;
-		}
-		if (!isSection(key)) {
-			warnings.push(unknown(key, TOP_LEVEL));
-			continue;
-		}
-		if (entry === void 0) continue;
-		if (!isRecord(entry)) throw new CliError("usage", `PermDock CLI: ${file}: ${key} must be an object`);
-		const known = SECTIONS[key];
-		for (const child of Object.keys(entry)) if (!Object.hasOwn(known, child)) warnings.push(unknown(`${key}.${child}`, Object.keys(known)));
-	}
-	return {
-		config: value,
-		warnings
-	};
-}
-//#endregion
-//#region src/cli/project/config.ts
-const CONFIG_FILES = [
-	"permdock.config.ts",
-	"permdock.config.mts",
-	"permdock.config.js",
-	"permdock.config.mjs"
-];
-function defineConfig(config) {
-	return config;
-}
-function isConfigFile(name) {
-	return CONFIG_FILES.some((file) => file === name);
-}
-async function readConfig(cwd, fromFlag, options) {
-	const path = fromFlag ? resolve(cwd, fromFlag) : CONFIG_FILES.map((name) => resolve(cwd, name)).find((file) => existsSync(file));
-	if (path === void 0) return {
-		config: {},
-		warnings: [],
-		file: void 0
-	};
-	if (!existsSync(path)) throw new CliError("usage", `PermDock CLI: config file not found: ${path}`, { code: "config_not_found" });
-	const { loadModule, pickNamed } = await import("./load-DrMHXzgN.js");
-	return {
-		...parseConfig(pickNamed(await loadModule(path, options), ["default"]), relative(cwd, path).replaceAll("\\", "/")),
-		file: path
-	};
-}
-async function loadConfig(cwd, fromFlag, options) {
-	return (await readConfig(cwd, fromFlag, options)).config;
-}
-function resolveCwd(cwd, fallback) {
-	return cwd === void 0 ? fallback : resolve(fallback, cwd);
-}
-//#endregion
-export { resolveCwd as a, readConfig as i, isConfigFile as n, loadConfig as r, defineConfig as t };

package/dist/denied-text-D4qkEtFz.d.ts

@@ -1,19 +0,0 @@
-import { Ln as Decision } from "./policy-types-B-F-qAZk.js";
-import { u as Permission } from "./permission-types-DhNEmoRG.js";
-//#region src/agent/denied-text.d.ts
-/** What an agent adapter's `deniedText` receives: the refusal and the text PermDock wrote for it. */
-type DeniedTextEvent = {
-  readonly decision: Exclude<Decision, {
-    readonly outcome: "granted";
-  }> | null;
-  readonly permission: Permission | undefined;
-  readonly text: string;
-};
-/**
- * Replaces the human-readable text of a refusal, and nothing else: the
- * outcome, `isError`, the structured content and the approval token stay.
- * `undefined` keeps PermDock's text.
- */
-type DeniedText = (event: DeniedTextEvent) => string | undefined;
-//#endregion
-export { DeniedTextEvent as n, DeniedText as t };

package/dist/fields-ClcQLrVc.js

@@ -1,238 +0,0 @@
-import { i as configError } from "./errors-DpP_U6Bf.js";
-import { c as jsonSchemaOf } from "./catalog-doc-CV9s6B1S.js";
-import { A as quoteQualified, E as helperSchema, O as quoteIdent, k as quoteLiteral, s as signedIn } from "./shared-fMKOv8hP.js";
-import { c as branchClauses, i as orSql, s as andSql, u as wrapSql } from "./policies-B2lZIurj.js";
-//#region src/cli/rls/fields.ts
-/** Names of the field-view objects. Part of the SQL contract. */
-const FIELD_VIEWS = {
-	/** `<table>_visible`: the `security_invoker` view clients read. */
-	view: "_visible",
-	/** `<table>_visible_fields`: the owner-rights companion `--revoke-columns` adds. */
-	companion: "_visible_fields",
-	/** The companion's row-key column, joined to the base table's key. */
-	key: "permdock_key",
-	/** Marks the companion so doctor PD022 knows it reads as its owner on purpose. */
-	comment: "permdock:field-companion",
-	/** `<table>_mask(p_row)`: the row-masking function `fields: 'mask'` adds. */
-	mask: "_mask"
-};
-function covers(branch, column) {
-	return branch.fields === void 0 || branch.fields.includes(column);
-}
-/**
-* A read grant that only shapes columns: a field-limited deny (it never
-* denies the row) or an allow with an empty list (it grants nothing). With
-* field views it leaves the row policy and lives in the view's masks.
-*/
-function fieldOnly(branch) {
-	if (branch.command !== "select" || branch.fields === void 0) return false;
-	return branch.effect === "deny" || branch.fields.length === 0;
-}
-/** Branches the row policies keep when field views compile. */
-function rowBranches(branches) {
-	return branches.filter((branch) => !fieldOnly(branch));
-}
-/**
-* Whether the reader is signed in, for branches with no helper call: a grant
-* to any signed-in user relies on `to authenticated` in its policy, which a
-* view does not have.
-*/
-function audience(ctx, branch) {
-	if (branch.access !== void 0 || branch.roles.length !== 1) return;
-	if (branch.roles[0] === "authenticated") return signedIn(ctx);
-	return branch.roles[0] === "anon" ? `not (${signedIn(ctx)})` : void 0;
-}
-function clause(ctx, branch) {
-	return andSql(audience(ctx, branch), branchClauses(branch).using) ?? "true";
-}
-/**
-* `can(permission, row, { field })` in SQL: an allow that covers the column
-* holds for the row and no covering deny does. Every access term is the
-* uncorrelated helper call the row policy uses, so it runs once per statement.
-*/
-function maskSql(ctx, allows, denies, column) {
-	const allowed = allows.filter((branch) => covers(branch, column)).map((branch) => clause(ctx, branch));
-	if (allowed.length === 0) return "false";
-	const denied = denies.filter((branch) => covers(branch, column)).map((branch) => clause(ctx, branch));
-	const allow = orSql(allowed);
-	if (denied.length === 0) return allow;
-	const deny = orSql(denied);
-	return allow === "true" ? `not ${wrapSql(deny)}` : `${wrapSql(allow)} and not ${wrapSql(deny)}`;
-}
-function schemaColumns(policy, resource) {
-	const node = policy.resources.get(resource);
-	const schema = node === void 0 ? null : jsonSchemaOf(node);
-	const properties = schema !== null && typeof schema === "object" ? schema.properties : void 0;
-	return properties !== null && typeof properties === "object" ? Object.keys(properties) : void 0;
-}
-function viewName(table, suffix) {
-	return `${table}${suffix}`;
-}
-/**
-* `<helper schema>.<table><suffix>`: outside the Data API's schemas, so the
-* companion's owner rights reach clients only through the `_visible` join and
-* the mask function is neither an RPC nor a computed field.
-*/
-function helperObjectName(ctx, table, suffix) {
-	const base = table.startsWith("public.") ? table.slice(7) : table.replaceAll(".", "_");
-	return `${helperSchema(ctx)}.${viewName(base, suffix)}`;
-}
-/**
-* One view per table whose read grants limit fields. A column is restricted
-* when some read allow lists fields without it or some read deny lists it;
-* every other column, and the row key, passes through unchanged.
-*/
-function fieldViews(policy, ctx, branches, options, warnings) {
-	const byTable = /* @__PURE__ */ new Map();
-	for (const branch of branches) {
-		if (branch.command !== "select" || branch.coverage === true) continue;
-		byTable.set(branch.table, [...byTable.get(branch.table) ?? [], branch]);
-	}
-	const views = [];
-	for (const [table, reads] of byTable) {
-		const allows = reads.filter((branch) => branch.effect === "allow" && branch.fields?.length !== 0);
-		const denies = reads.filter((branch) => branch.effect === "deny");
-		const limited = reads.some((branch) => branch.fields !== void 0);
-		const resource = reads.find((branch) => branch.resource !== void 0)?.resource;
-		if (!limited || allows.length === 0 || resource === void 0) continue;
-		const names = schemaColumns(policy, resource);
-		if (names === void 0) throw configError(`PermDock CLI: --fields ${options.mask === true ? "mask" : "views"} needs the ${resource} schema's JSON Schema (Standard JSON Schema) to list the columns of ${table}`);
-		const key = policy.resources.get(resource)?.id ?? "id";
-		const restricted = (column) => column !== key && (allows.some((branch) => branch.fields !== void 0 && !branch.fields.includes(column)) || denies.some((branch) => branch.fields?.includes(column) === true));
-		const columns = names.map((name) => {
-			quoteIdent(name);
-			return restricted(name) ? {
-				name,
-				mask: maskSql(ctx, allows, denies, name)
-			} : { name };
-		});
-		if (columns.every((column) => column.mask === void 0)) continue;
-		const view = viewName(table, FIELD_VIEWS.view);
-		if (allows.some((branch) => branch.fields !== void 0 && !branch.fields.includes(key))) warnings.push(`field view ${view}: the key ${key} passes through, although a read grant on ${resource} omits it`);
-		const hidden = columns.filter((column) => column.mask !== void 0).map((column) => column.name);
-		if (options.helpersOnly === true) warnings.push(`field view ${view}: ${table} still returns ${hidden.join(", ")} to direct reads; revoke select on those columns from client roles in your own grants, or read them through a function`);
-		else if (!options.revokeColumns) warnings.push(`field view ${view}: ${table} still returns ${hidden.join(", ")} to direct reads; add --revoke-columns so clients read through the view`);
-		views.push({
-			resource,
-			table,
-			view,
-			key,
-			columns,
-			roles: reads.some((branch) => branch.roles.includes("anon")) ? ["anon", "authenticated"] : ["authenticated"],
-			...options.revokeColumns ? { companion: helperObjectName(ctx, table, FIELD_VIEWS.companion) } : {},
-			...options.mask === true ? { maskFunction: helperObjectName(ctx, table, FIELD_VIEWS.mask) } : {}
-		});
-	}
-	return views;
-}
-/** Columns of `view`'s table that `anon` and `authenticated` keep on the base table with `--revoke-columns`. */
-function readableColumns(view) {
-	return view.columns.filter((column) => column.mask === void 0).map((column) => column.name);
-}
-function restrictedColumns(view) {
-	return view.columns.filter((column) => column.mask !== void 0).map((column) => column.name);
-}
-function columnList(names) {
-	return names.map(quoteIdent).join(", ");
-}
-function selectList(lines) {
-	return lines.map((line) => `  ${line}`).join(",\n");
-}
-function grantView(name, roles) {
-	return [`revoke all on table ${quoteQualified(name)} from anon, authenticated, public;`, `grant select on table ${quoteQualified(name)} to ${roles.join(", ")};`].join("\n");
-}
-function inlineViewSql(view) {
-	const targets = view.columns.map((column) => column.mask === void 0 ? quoteIdent(column.name) : `case when ${column.mask} then ${quoteIdent(column.name)} end as ${quoteIdent(column.name)}`);
-	return `create or replace view ${quoteQualified(view.view)} with (security_invoker = true) as
-select
-${selectList(targets)}
-from ${quoteQualified(view.table)};`;
-}
-function companionSql(view, companion) {
-	const restricted = view.columns.filter((column) => column.mask !== void 0);
-	const targets = [`${quoteIdent(view.key)} as ${quoteIdent(FIELD_VIEWS.key)}`, ...restricted.map((column) => `case when ${column.mask} then ${quoteIdent(column.name)} end as ${quoteIdent(column.name)}`)];
-	const any = orSql(restricted.map((column) => column.mask ?? "false"));
-	const name = companion.slice(0, companion.indexOf("."));
-	const schema = quoteIdent(name);
-	return `${name === "public" ? "" : `create schema if not exists ${schema};
-revoke all on schema ${schema} from public;
-grant usage on schema ${schema} to ${view.roles.join(", ")};
-`}create or replace view ${quoteQualified(companion)} with (security_barrier = true) as
-select
-${selectList(targets)}
-from ${quoteQualified(view.table)}
-where ${any};
-comment on view ${quoteQualified(companion)} is ${quoteLiteral(`${FIELD_VIEWS.comment} ${view.view}`)};`;
-}
-function joinedViewSql(view, companion) {
-	const targets = view.columns.map((column) => column.mask === void 0 ? `t.${quoteIdent(column.name)}` : `f.${quoteIdent(column.name)}`);
-	return `create or replace view ${quoteQualified(view.view)} with (security_invoker = true) as
-select
-${selectList(targets)}
-from ${quoteQualified(view.table)} t
-left join ${quoteQualified(companion)} f on f.${quoteIdent(FIELD_VIEWS.key)} = t.${quoteIdent(view.key)};`;
-}
-/** `select` on only the unrestricted columns (and the key) of the base table, for `--revoke-columns`. */
-function columnGrantSql(view, role) {
-	return `grant select (${columnList(readableColumns(view))}) on table ${quoteQualified(view.table)} to ${role};`;
-}
-function columnRevokeSql(view) {
-	return `revoke select (${columnList(restrictedColumns(view))}) on table ${quoteQualified(view.table)} from anon, authenticated;`;
-}
-/**
-* `<table>_mask(p_row)`: the row with each restricted column the caller may
-* not read set to null, by the same masks as the view. It reads only the row
-* it is given, so its caller decides which rows; `security invoker`, because
-* it needs nothing beyond the helpers the masks call. The body names the
-* parameter `$1`, since a column called `p_row` would shadow the name.
-*/
-function maskFunctionSql(view, fn) {
-	const table = quoteQualified(view.table);
-	const name = quoteQualified(fn);
-	const nulls = view.columns.flatMap((column) => column.mask === void 0 ? [] : [`case when ${column.mask} then '{}'::jsonb else pg_catalog.jsonb_build_object(${quoteLiteral(column.name)}, null) end`]);
-	return `-- ${fn}: a row of ${view.table} with ${restrictedColumns(view).join(", ")} null unless a read grant covers the column for the row, for SQL that reads ${view.table} without ${view.view}
-create or replace function ${name}(p_row ${table})
-returns ${table}
-language sql
-stable
-security invoker
-set search_path = ''
-as $$
-  select pg_catalog.jsonb_populate_record(
-    $1,
-    ${nulls.join("\n    || ")}
-  )
-  from (select ($1).*) r
-$$;
-revoke all on function ${name}(${table}) from public, anon, authenticated;
-grant execute on function ${name}(${table}) to ${view.roles.join(", ")};`;
-}
-/**
-* The view SQL: the `security_invoker` view, and with `--revoke-columns` the
-* owner-rights companion it joins for the restricted columns. The companion
-* masks every column with the full field decision and keeps only rows where
-* one is readable, so reading it directly shows nothing `pick` would not.
-*/
-function fieldViewsSql(views) {
-	return views.map((view) => {
-		const head = `-- field view over ${view.table}: ${restrictedColumns(view).join(", ")} read as null unless a read grant covers the column for the row`;
-		const mask = view.maskFunction === void 0 ? [] : [maskFunctionSql(view, view.maskFunction)];
-		if (view.companion === void 0) return [
-			head,
-			inlineViewSql(view),
-			grantView(view.view, view.roles),
-			...mask
-		].join("\n");
-		return [
-			head,
-			`-- ${view.companion} reads ${view.table} as its owner; ${view.view} reads the rows as the caller and joins it`,
-			companionSql(view, view.companion),
-			grantView(view.companion, view.roles),
-			joinedViewSql(view, view.companion),
-			grantView(view.view, view.roles),
-			...mask
-		].join("\n");
-	}).join("\n\n");
-}
-//#endregion
-export { fieldViewsSql as a, fieldViews as i, columnGrantSql as n, rowBranches as o, columnRevokeSql as r, viewName as s, FIELD_VIEWS as t };

package/dist/generate-CNU1pIOo.js

@@ -1,171 +0,0 @@
-import { r as isRecord } from "./compact-CAf557ZB.js";
-import { t as byCodePoint } from "./compare-pfyVnBjE.js";
-//#region src/cli/generate.ts
-const IDENTIFIER = /^[A-Za-z_$][A-Za-z0-9_$]*$/u;
-const MAX_DEPTH = 6;
-function isSchemaKind(value) {
-	return value === "zod" || value === "valibot" || value === "arktype";
-}
-function schemaImport(kind) {
-	switch (kind) {
-		case "zod": return "import { z } from 'zod'";
-		case "valibot": return "import * as v from 'valibot'";
-		case "arktype": return "import { type } from 'arktype'";
-		default: return kind;
-	}
-}
-function emptySchema(kind) {
-	return schemaExpression(kind, { type: "object" });
-}
-function propertyKey(name) {
-	return IDENTIFIER.test(name) ? name : JSON.stringify(name);
-}
-function literalEnum(schema) {
-	const values = schema["enum"];
-	if (!Array.isArray(values) || values.length === 0 || !values.every((value) => typeof value === "string")) return;
-	return values;
-}
-function schemaType(schema) {
-	const type = schema["type"];
-	if (typeof type === "string") return type;
-	if (Array.isArray(type)) {
-		const named = type.filter((item) => item !== "null");
-		return named.length === 1 && typeof named[0] === "string" ? named[0] : void 0;
-	}
-	return isRecord(schema["properties"]) ? "object" : void 0;
-}
-function zodOf(schema, resolve, depth) {
-	const node = resolve(schema);
-	const values = literalEnum(node);
-	if (values !== void 0) return `z.enum(${JSON.stringify(values)})`;
-	const type = depth > MAX_DEPTH ? void 0 : schemaType(node);
-	if (type === void 0) return "z.unknown()";
-	switch (type) {
-		case "string": return "z.string()";
-		case "number": return "z.number()";
-		case "integer": return "z.number().int()";
-		case "boolean": return "z.boolean()";
-		case "array": return `z.array(${isRecord(node["items"]) ? zodOf(node["items"], resolve, depth + 1) : "z.unknown()"})`;
-		case "object": {
-			const required = new Set(Array.isArray(node["required"]) ? node["required"] : []);
-			const properties = isRecord(node["properties"]) ? node["properties"] : {};
-			const fields = Object.entries(properties).filter((entry) => isRecord(entry[1])).map(([name, child]) => {
-				const expression = zodOf(child, resolve, depth + 1);
-				return `${propertyKey(name)}: ${required.has(name) ? expression : `${expression}.optional()`}`;
-			});
-			return `z.object({${fields.length === 0 ? "" : ` ${fields.join(", ")} `}})`;
-		}
-		default: return "z.unknown()";
-	}
-}
-function valibotOf(schema, resolve, depth) {
-	const node = resolve(schema);
-	const values = literalEnum(node);
-	if (values !== void 0) return `v.picklist(${JSON.stringify(values)})`;
-	const type = depth > MAX_DEPTH ? void 0 : schemaType(node);
-	if (type === void 0) return "v.unknown()";
-	switch (type) {
-		case "string": return "v.string()";
-		case "number": return "v.number()";
-		case "integer": return "v.pipe(v.number(), v.integer())";
-		case "boolean": return "v.boolean()";
-		case "array": return `v.array(${isRecord(node["items"]) ? valibotOf(node["items"], resolve, depth + 1) : "v.unknown()"})`;
-		case "object": {
-			const required = new Set(Array.isArray(node["required"]) ? node["required"] : []);
-			const properties = isRecord(node["properties"]) ? node["properties"] : {};
-			const fields = Object.entries(properties).filter((entry) => isRecord(entry[1])).map(([name, child]) => {
-				const expression = valibotOf(child, resolve, depth + 1);
-				return `${propertyKey(name)}: ${required.has(name) ? expression : `v.optional(${expression})`}`;
-			});
-			return `v.object({${fields.length === 0 ? "" : ` ${fields.join(", ")} `}})`;
-		}
-		default: return "v.unknown()";
-	}
-}
-/** An arktype definition: a string keyword or an object literal. */
-function arktypeOf(schema, resolve, depth) {
-	const node = resolve(schema);
-	const values = literalEnum(node);
-	if (values !== void 0) return JSON.stringify(values.map((value) => `'${value.replaceAll("'", "\\'")}'`).join(" | "));
-	const type = depth > MAX_DEPTH ? void 0 : schemaType(node);
-	if (type === void 0) return "'unknown'";
-	switch (type) {
-		case "string": return "'string'";
-		case "number": return "'number'";
-		case "integer": return "'number.integer'";
-		case "boolean": return "'boolean'";
-		case "array": {
-			if (!isRecord(node["items"])) return "'unknown[]'";
-			const item = arktypeOf(node["items"], resolve, depth + 1);
-			return item.startsWith("'") && !item.includes("|") ? `'${item.slice(1, -1)}[]'` : `[${item}, '[]']`;
-		}
-		case "object": {
-			const required = new Set(Array.isArray(node["required"]) ? node["required"] : []);
-			const properties = isRecord(node["properties"]) ? node["properties"] : {};
-			const fields = Object.entries(properties).filter((entry) => isRecord(entry[1])).map(([name, child]) => `${JSON.stringify(required.has(name) ? name : `${name}?`)}: ${arktypeOf(child, resolve, depth + 1)}`);
-			return `{${fields.length === 0 ? "" : ` ${fields.join(", ")} `}}`;
-		}
-		default: return "'unknown'";
-	}
-}
-/**
-* A validator expression for a JSON Schema object. Only the portable core
-* (primitives, enums of strings, arrays, objects with `required`) is
-* translated; anything else becomes the validator's `unknown`.
-*/
-function schemaExpression(kind, schema, resolve = (node) => node) {
-	switch (kind) {
-		case "zod": return zodOf(schema, resolve, 0);
-		case "valibot": return valibotOf(schema, resolve, 0);
-		case "arktype": return `type(${arktypeOf(schema, resolve, 0)})`;
-		default: return kind;
-	}
-}
-function renderList(value, indent) {
-	if (Array.isArray(value)) return JSON.stringify(value);
-	return JSON.stringify(value, null, 2).replaceAll("\n", `\n${indent}`);
-}
-function renderResource(resource, indent) {
-	const inner = `${indent}  `;
-	const options = [
-		`${inner}id: '${(resource.id ?? "id").replaceAll("\\", "\\\\").replaceAll("'", "\\'")}',`,
-		`${inner}actions: ${renderList(resource.actions, inner)},`,
-		`${inner}collection: ${renderList(resource.collection, inner)},`
-	].join("\n");
-	return `${resource.schema === void 0 ? "resource({" : `resource(${resource.schema}, {`}\n${options}\n${indent}})`;
-}
-function insert(trie, resource) {
-	let node = trie;
-	for (const [index, segment] of resource.path.entries()) {
-		if (index === resource.path.length - 1) {
-			node.set(segment, resource);
-			return;
-		}
-		const next = node.get(segment);
-		if (next instanceof Map) node = next;
-		else {
-			const created = /* @__PURE__ */ new Map();
-			node.set(segment, created);
-			node = created;
-		}
-	}
-}
-function renderTrie(trie, indent) {
-	return [...trie.entries()].toSorted(([a], [b]) => byCodePoint(a, b)).map(([segment, value]) => value instanceof Map ? `${indent}${propertyKey(segment)}: {\n${renderTrie(value, `${indent}  `)}\n${indent}},` : `${indent}${propertyKey(segment)}: ${renderResource(value, indent)},`).join("\n");
-}
-/** A deterministic `definePermissions()` module with a `// @generated` header. */
-function emitPermissionsModule(input) {
-	const trie = /* @__PURE__ */ new Map();
-	for (const resource of input.resources) insert(trie, resource);
-	const imports = ["import { definePermissions, resource } from 'permdock'", ...input.schema === void 0 ? [] : [schemaImport(input.schema)]];
-	const extras = Object.entries(input.exports ?? {}).map(([name, value]) => `export const ${name} = ${JSON.stringify(value, null, 2)} as const\n\n`);
-	return `// @generated by permdock ${input.generator}
-${imports.join("\n")}
-
-${extras.join("")}export const permissions = definePermissions({
-${renderTrie(trie, "  ")}
-})
-`;
-}
-//#endregion
-export { schemaExpression as i, emptySchema as n, isSchemaKind as r, emitPermissionsModule as t };

package/dist/headers-BIjfMaoC.js

@@ -1,8 +0,0 @@
-import { t as approvalHeaderValue } from "./approval-header-CJACtHkv.js";
-//#region src/client/headers.ts
-/** The `PermDock-Approval` header for a resume; a `TypeError` for a token that is not an RFC 9651 sf-token. */
-function approvalHeaders(token) {
-	return { "PermDock-Approval": approvalHeaderValue(token) };
-}
-//#endregion
-export { approvalHeaders as t };

package/dist/headers-CIbDTUTK.d.ts

@@ -1,7 +0,0 @@
-//#region src/client/headers.d.ts
-/** The `PermDock-Approval` header for a resume; a `TypeError` for a token that is not an RFC 9651 sf-token. */
-declare function approvalHeaders(token: string): {
-  readonly "PermDock-Approval": string;
-};
-//#endregion
-export { approvalHeaders as t };

package/dist/load-DrMHXzgN.js

@@ -1 +0,0 @@
-export { a as loadModule, s as pickNamed } from "./load-DxroEzH1.js";

package/dist/output-files-DPAY7-GX.js

@@ -1 +0,0 @@
-export { t as SPLIT_PARTS } from "./output-files-CCMdcFWb.js";

package/dist/package-root-Dk_ETdkp.js

@@ -1,31 +0,0 @@
-import { i as readJsonFile } from "./files-D_JIzUrP.js";
-import { existsSync } from "node:fs";
-import { dirname, join } from "node:path";
-import { fileURLToPath } from "node:url";
-//#region src/cli/project/package-root.ts
-let cached;
-/**
-* The `permdock` package directory. The bundler may place this module in
-* `dist/cli/` or in a shared chunk at `dist/`, so walk up instead of
-* assuming a depth.
-*/
-function packageRoot() {
-	cached ??= findPackageRoot(dirname(fileURLToPath(import.meta.url)));
-	return cached;
-}
-/** The nearest directory at or above `start` whose `package.json` is named `permdock`. */
-function findPackageRoot(start) {
-	let dir = start;
-	for (;;) {
-		const manifest = join(dir, "package.json");
-		if (existsSync(manifest)) {
-			const { name } = readJsonFile(manifest);
-			if (name === "permdock") return dir;
-		}
-		const parent = dirname(dir);
-		if (parent === dir) throw new Error("PermDock CLI: cannot find the permdock package root");
-		dir = parent;
-	}
-}
-//#endregion
-export { packageRoot as t };

package/dist/parse-local-manifest-e4mdwAKd.d.ts

@@ -1,10 +0,0 @@
-import { Ut as LocalSnapshotManifest } from "./policy-types-B-F-qAZk.js";
-//#region src/core/parse-local-manifest.d.ts
-/**
- * Whether `value` has the shape `localSnapshotManifest(policy)` writes, with
- * no prototype keys. A JSON import widens `v: 1` to `number`; this narrows it
- * back without a cast.
- */
-declare function parseLocalSnapshotManifest(value: unknown): value is LocalSnapshotManifest;
-//#endregion
-export { parseLocalSnapshotManifest as t };