@shipdit/cli 0.2.2 → 0.3.1

package/dist/index.mjs

@@ -77,7 +77,7 @@ function resolveRuntimeConfig(flags, options) {
 }
 
 //#endregion
-//#region ../../node_modules/.pnpm/hono@4.13.0/node_modules/hono/dist/utils/cookie.js
+//#region ../../node_modules/.pnpm/hono@4.13.5/node_modules/hono/dist/utils/cookie.js
 var validCookieNameRegEx = /^[\w!#$%&'*.^`|~+-]+$/;
 var _serialize = (name, value, opt = {}) => {
 	if (!validCookieNameRegEx.test(name)) throw new Error("Invalid cookie name");
@@ -120,7 +120,7 @@ var serialize = (name, value, opt) => {
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/hono@4.13.0/node_modules/hono/dist/client/utils.js
+//#region ../../node_modules/.pnpm/hono@4.13.5/node_modules/hono/dist/client/utils.js
 var mergePath = (base, path) => {
 	base = base.replace(/\/+$/, "");
 	base = base + "/";
@@ -130,7 +130,7 @@ var mergePath = (base, path) => {
 var replaceUrlParam = (urlString, params) => {
 	for (const [k, v] of Object.entries(params)) {
 		const reg = new RegExp("/:" + k + "(?:{[^/]+})?\\??(?=/|$)");
-		urlString = urlString.replace(reg, v ? `/${v}` : "");
+		urlString = urlString.replace(reg, () => v ? `/${v}` : "");
 	}
 	return urlString;
 };
@@ -138,7 +138,10 @@ var buildSearchParams = (query) => {
 	const searchParams = new URLSearchParams();
 	for (const [k, v] of Object.entries(query)) {
 		if (v === void 0) continue;
-		if (Array.isArray(v)) for (const v2 of v) searchParams.append(k, v2);
+		if (Array.isArray(v)) for (const v2 of v) {
+			if (v2 === void 0) continue;
+			searchParams.append(k, v2);
+		}
 		else searchParams.set(k, v);
 	}
 	return searchParams;
@@ -168,7 +171,7 @@ function deepMerge(target, source) {
 }
 
 //#endregion
-//#region ../../node_modules/.pnpm/hono@4.13.0/node_modules/hono/dist/client/client.js
+//#region ../../node_modules/.pnpm/hono@4.13.5/node_modules/hono/dist/client/client.js
 var createProxy = (callback, path) => {
 	return new Proxy(() => {}, {
 		get(_obj, key) {
@@ -183,6 +186,10 @@ var createProxy = (callback, path) => {
 		}
 	});
 };
+var appendQueryParams = (url, searchParams) => {
+	const queryString = searchParams.toString();
+	return queryString ? `${url}?${queryString}` : url;
+};
 var ClientRequestImpl = class {
 	url;
 	method;
@@ -203,12 +210,15 @@ var ClientRequestImpl = class {
 				const form = new FormData();
 				for (const [k, v] of Object.entries(args.form)) {
 					if (v === void 0) continue;
-					if (Array.isArray(v)) for (const v2 of v) form.append(k, v2);
+					if (Array.isArray(v)) for (const v2 of v) {
+						if (v2 === void 0) continue;
+						form.append(k, v2);
+					}
 					else form.append(k, v);
 				}
 				this.rBody = form;
 			}
-			if (args.json) {
+			if (args.json !== void 0) {
 				this.rBody = JSON.stringify(args.json);
 				this.cType = "application/json";
 			}
@@ -221,15 +231,19 @@ var ClientRequestImpl = class {
 		};
 		if (args?.cookie) {
 			const cookies = [];
-			for (const [key, value] of Object.entries(args.cookie)) cookies.push(serialize(key, value, { path: "/" }));
-			headerValues["Cookie"] = cookies.join(",");
+			for (const [key, value] of Object.entries(args.cookie)) {
+				if (value === void 0) continue;
+				cookies.push(serialize(key, value));
+			}
+			if (cookies.length > 0) headerValues["Cookie"] = cookies.join("; ");
 		}
 		if (this.cType) headerValues["Content-Type"] = this.cType;
-		const headers = new Headers(headerValues ?? void 0);
+		const headers = new Headers();
+		for (const [key, value] of Object.entries(headerValues)) if (value !== void 0) headers.set(key, value);
 		let url = this.url;
 		url = removeIndexString(url);
 		url = replaceUrlParam(url, this.pathParams);
-		if (this.queryParams) url = url + "?" + this.queryParams.toString();
+		if (this.queryParams) url = appendQueryParams(url, this.queryParams);
 		methodUpperCase = this.method.toUpperCase();
 		const setBody = !(methodUpperCase === "GET" || methodUpperCase === "HEAD");
 		return (opt?.fetch || fetch)(url, {
@@ -263,19 +277,18 @@ var hc = (baseUrl, options) => createProxy(function proxyCallback(opts) {
 		let result = url;
 		if (opts.args[0]) {
 			if (opts.args[0].param) result = replaceUrlParam(url, opts.args[0].param);
-			if (opts.args[0].query) result = result + "?" + buildSearchParamsOption(opts.args[0].query).toString();
+			if (opts.args[0].query) result = appendQueryParams(result, buildSearchParamsOption(opts.args[0].query));
 		}
 		result = removeIndexString(result);
 		if (method === "url") return new URL(result);
 		return result.slice(baseUrl.replace(/\/+$/, "").length).replace(/^\/?/, "/");
 	}
 	if (method === "ws") {
-		const webSocketUrl = replaceUrlProtocol(opts.args[0] && opts.args[0].param ? replaceUrlParam(url, opts.args[0].param) : url, "ws");
+		const webSocketUrl = replaceUrlProtocol(opts.args[0]?.param ? replaceUrlParam(url, opts.args[0].param) : url, "ws");
 		const targetUrl = new URL(webSocketUrl);
 		const queryParams = opts.args[0]?.query;
-		if (queryParams) Object.entries(queryParams).forEach(([key, value]) => {
-			if (Array.isArray(value)) value.forEach((item) => targetUrl.searchParams.append(key, item));
-			else targetUrl.searchParams.set(key, value);
+		if (queryParams) buildSearchParamsOption(queryParams).forEach((value, key) => {
+			targetUrl.searchParams.append(key, value);
 		});
 		const establishWebSocket = (...args) => {
 			if (options?.webSocket !== void 0 && typeof options.webSocket === "function") return options.webSocket(...args);
@@ -307,7 +320,12 @@ const t$2 = [
 	`not_found`,
 	`conflict`,
 	`validation_error`,
-	`internal`
+	`payload_too_large`,
+	`quota_exceeded`,
+	`rate_limited`,
+	`internal`,
+	`tenant_migrating`,
+	`tenant_unavailable`
 ];
 function n$2(e) {
 	if (typeof e != `object` || !e || !(`error` in e)) return !1;
@@ -321,22 +339,26 @@ var r$1 = class e extends Error {
 	status;
 	requestId;
 	details;
+	retryAfterSeconds;
 	constructor(e) {
-		super(e.message), this.name = `ShipdApiError`, this.code = e.code, this.status = e.status, this.requestId = e.requestId, this.details = e.details;
+		super(e.message), this.name = `ShipdApiError`, this.code = e.code, this.status = e.status, this.requestId = e.requestId, this.details = e.details, this.retryAfterSeconds = e.retryAfterSeconds;
 	}
-	static fromResponse(r, i) {
+	static fromResponse(r, i, a) {
+		let o = a == null ? NaN : Number(a), s = Number.isFinite(o) && o >= 0 ? o : void 0;
 		return n$2(i) ? new e({
 			code: t$2.includes(i.error.code) ? i.error.code : `unknown`,
 			message: i.error.message,
 			status: r,
 			requestId: i.error.requestId,
-			details: i.error.details
+			details: i.error.details,
+			retryAfterSeconds: s
 		}) : new e({
 			code: `unknown`,
 			message: `Request failed with status ${r}`,
 			status: r,
 			requestId: `unknown`,
-			details: i
+			details: i,
+			retryAfterSeconds: s
 		});
 	}
 };
@@ -352,7 +374,7 @@ async function i$1(e) {
 			requestId: `unknown`
 		});
 	}
-	if (!e.ok) throw r$1.fromResponse(e.status, t);
+	if (!e.ok) throw r$1.fromResponse(e.status, t, e.headers.get(`retry-after`));
 	if (typeof t != `object` || !t || !(`data` in t)) throw new r$1({
 		code: `internal`,
 		message: `Malformed success response`,
@@ -379,10 +401,12 @@ const v$1 = (...t) => hc(...t);
 const y$1 = (...t) => hc(...t);
 const b$1 = (...t) => hc(...t);
 const x$1 = (...t) => hc(...t);
-function S$1(e) {
+const S$1 = (...t) => hc(...t);
+const C$1 = (...t) => hc(...t);
+function w$1(e) {
 	return `${e.replace(/\/+$/, ``)}/api/v1/rpc`;
 }
-function C$1(e) {
+function T$1(e) {
 	return {
 		...e.fetch ? { fetch: e.fetch } : {},
 		init: { credentials: e.client === `dashboard` ? `include` : `same-origin` },
@@ -392,142 +416,171 @@ function C$1(e) {
 		}
 	};
 }
-async function w$1(e, t) {
+async function E$1(e, t) {
 	return i$1(await e({ json: t }));
 }
-function T$1(e) {
-	let t = S$1(e.baseUrl), n = C$1(e), r = a$1(t, n), i = o$1(t, n), T = s$1(t, n), E = c$1(t, n), D = l$1(t, n), O = u$1(t, n), k = d$2(t, n), A = f$2(t, n), j = g$1(t, n), M = h$1(t, n), N = p$1(t, n), P = m$1(t, n), F = _$1(t, n), I = v$1(t, n), L = y$1(t, n), R = b$1(t, n), z = x$1(t, n);
+async function D$1(e, t) {
+	let n = await e({ json: t });
+	return {
+		items: await i$1(n),
+		nextCursor: n.headers.get(`next-cursor`)
+	};
+}
+function O$1(e) {
+	let t = w$1(e.baseUrl), n = T$1(e), r = a$1(t, n), i = o$1(t, n), O = s$1(t, n), k = c$1(t, n), A = l$1(t, n), j = u$1(t, n), M = d$2(t, n), N = f$2(t, n), P = g$1(t, n), F = h$1(t, n), I = p$1(t, n), L = m$1(t, n), R = _$1(t, n), z = v$1(t, n), B = y$1(t, n), V = C$1(t, n), H = b$1(t, n), U = x$1(t, n), W = S$1(t, n);
 	return {
 		me: {
-			get: (e = {}) => w$1(r.me.$post, e),
-			feedback: (e) => w$1(r.me.feedback.$post, e)
+			get: (e = {}) => E$1(r.me.$post, e),
+			feedback: (e) => E$1(r.me.feedback.$post, e)
 		},
 		project: {
-			list: (e = {}) => w$1(i.project.list.$post, e),
-			create: (e) => w$1(i.project.create.$post, e),
-			update: (e) => w$1(i.project.update.$post, e),
-			archive: (e) => w$1(i.project.archive.$post, e),
-			listTeams: (e) => w$1(i.project.listTeams.$post, e),
-			setTeams: (e) => w$1(i.project.setTeams.$post, e)
+			list: (e = {}) => E$1(i.project.list.$post, e),
+			create: (e) => E$1(i.project.create.$post, e),
+			update: (e) => E$1(i.project.update.$post, e),
+			archive: (e) => E$1(i.project.archive.$post, e),
+			listTeams: (e) => E$1(i.project.listTeams.$post, e),
+			setTeams: (e) => E$1(i.project.setTeams.$post, e)
 		},
-		team: { listMembers: (e) => w$1(R.team.listMembers.$post, e) },
+		team: { listMembers: (e) => E$1(H.team.listMembers.$post, e) },
 		environment: {
-			list: (e) => w$1(T.environment.list.$post, e),
-			create: (e) => w$1(T.environment.create.$post, e),
-			update: (e) => w$1(T.environment.update.$post, e),
-			archive: (e) => w$1(T.environment.archive.$post, e)
+			list: (e) => E$1(O.environment.list.$post, e),
+			create: (e) => E$1(O.environment.create.$post, e),
+			update: (e) => E$1(O.environment.update.$post, e),
+			archive: (e) => E$1(O.environment.archive.$post, e)
 		},
 		flag: {
-			list: (e) => w$1(E.flag.list.$post, e),
-			get: (e) => w$1(E.flag.get.$post, e),
-			create: (e) => w$1(E.flag.create.$post, e),
-			update: (e) => w$1(E.flag.update.$post, e),
-			archive: (e) => w$1(E.flag.archive.$post, e),
-			updateEnvironment: (e) => w$1(E.flag.updateEnvironment.$post, e),
-			toggleEnvironment: (e) => w$1(E.flag.toggleEnvironment.$post, e),
-			listEnvironmentStates: (e) => w$1(E.flag.listEnvironmentStates.$post, e),
-			pull: (e) => w$1(E.flag.pull.$post, e),
-			diff: (e) => w$1(E.flag.diff.$post, e),
-			push: (e) => w$1(E.flag.push.$post, e)
+			list: (e) => E$1(k.flag.list.$post, e),
+			get: (e) => E$1(k.flag.get.$post, e),
+			create: (e) => E$1(k.flag.create.$post, e),
+			update: (e) => E$1(k.flag.update.$post, e),
+			archive: (e) => E$1(k.flag.archive.$post, e),
+			updateEnvironment: (e) => E$1(k.flag.updateEnvironment.$post, e),
+			toggleEnvironment: (e) => E$1(k.flag.toggleEnvironment.$post, e),
+			listEnvironmentStates: (e) => E$1(k.flag.listEnvironmentStates.$post, e),
+			pull: (e) => E$1(k.flag.pull.$post, e),
+			diff: (e) => E$1(k.flag.diff.$post, e),
+			push: (e) => E$1(k.flag.push.$post, e)
 		},
 		apiKey: {
-			list: (e = {}) => w$1(D.apiKey.list.$post, e),
-			create: (e) => w$1(D.apiKey.create.$post, e),
-			revoke: (e) => w$1(D.apiKey.revoke.$post, e)
+			list: (e = {}) => E$1(A.apiKey.list.$post, e),
+			create: (e) => E$1(A.apiKey.create.$post, e),
+			revoke: (e) => E$1(A.apiKey.revoke.$post, e)
 		},
 		sdkKey: {
-			list: (e = {}) => w$1(A.sdkKey.list.$post, e),
-			create: (e) => w$1(A.sdkKey.create.$post, e),
-			revoke: (e) => w$1(A.sdkKey.revoke.$post, e)
+			list: (e = {}) => E$1(N.sdkKey.list.$post, e),
+			create: (e) => E$1(N.sdkKey.create.$post, e),
+			revoke: (e) => E$1(N.sdkKey.revoke.$post, e)
 		},
 		serviceAccount: {
-			list: (e = {}) => w$1(j.serviceAccount.list.$post, e),
-			get: (e) => w$1(j.serviceAccount.get.$post, e),
-			create: (e) => w$1(j.serviceAccount.create.$post, e),
-			update: (e) => w$1(j.serviceAccount.update.$post, e),
-			disable: (e) => w$1(j.serviceAccount.disable.$post, e),
-			enable: (e) => w$1(j.serviceAccount.enable.$post, e),
-			delete: (e) => w$1(j.serviceAccount.delete.$post, e),
-			createToken: (e) => w$1(j.serviceAccount.createToken.$post, e),
-			listTokens: (e) => w$1(j.serviceAccount.listTokens.$post, e),
-			revokeToken: (e) => w$1(j.serviceAccount.revokeToken.$post, e)
+			list: (e = {}) => E$1(P.serviceAccount.list.$post, e),
+			get: (e) => E$1(P.serviceAccount.get.$post, e),
+			create: (e) => E$1(P.serviceAccount.create.$post, e),
+			update: (e) => E$1(P.serviceAccount.update.$post, e),
+			disable: (e) => E$1(P.serviceAccount.disable.$post, e),
+			enable: (e) => E$1(P.serviceAccount.enable.$post, e),
+			delete: (e) => E$1(P.serviceAccount.delete.$post, e),
+			createToken: (e) => E$1(P.serviceAccount.createToken.$post, e),
+			listTokens: (e) => E$1(P.serviceAccount.listTokens.$post, e),
+			revokeToken: (e) => E$1(P.serviceAccount.revokeToken.$post, e),
+			rotateToken: (e) => E$1(P.serviceAccount.rotateToken.$post, e)
 		},
 		segment: {
-			list: (e) => w$1(M.segment.list.$post, e),
-			get: (e) => w$1(M.segment.get.$post, e),
-			create: (e) => w$1(M.segment.create.$post, e),
-			update: (e) => w$1(M.segment.update.$post, e),
-			archive: (e) => w$1(M.segment.archive.$post, e),
-			listEnvironmentStates: (e) => w$1(M.segment.listEnvironmentStates.$post, e),
-			updateEnvironment: (e) => w$1(M.segment.updateEnvironment.$post, e)
+			list: (e) => E$1(F.segment.list.$post, e),
+			get: (e) => E$1(F.segment.get.$post, e),
+			create: (e) => E$1(F.segment.create.$post, e),
+			update: (e) => E$1(F.segment.update.$post, e),
+			archive: (e) => E$1(F.segment.archive.$post, e),
+			listEnvironmentStates: (e) => E$1(F.segment.listEnvironmentStates.$post, e),
+			updateEnvironment: (e) => E$1(F.segment.updateEnvironment.$post, e)
 		},
 		evaluatedEntity: {
-			list: (e) => w$1(N.evaluatedEntity.list.$post, e),
-			get: (e) => w$1(N.evaluatedEntity.get.$post, e),
-			delete: (e) => w$1(N.evaluatedEntity.delete.$post, e)
+			list: (e) => E$1(I.evaluatedEntity.list.$post, e),
+			listPage: (e) => D$1(I.evaluatedEntity.list.$post, e),
+			get: (e) => E$1(I.evaluatedEntity.get.$post, e),
+			delete: (e) => E$1(I.evaluatedEntity.delete.$post, e)
 		},
 		evaluationFact: {
-			list: (e) => w$1(P.evaluationFact.list.$post, e),
-			byRule: (e) => w$1(P.evaluationFact.byRule.$post, e),
-			orgSummary: (e = {}) => w$1(P.evaluationFact.orgSummary.$post, e),
-			projectSummary: (e) => w$1(P.evaluationFact.projectSummary.$post, e),
-			simulate: (e) => w$1(P.evaluationFact.simulate.$post, e)
+			list: (e) => E$1(L.evaluationFact.list.$post, e),
+			byRule: (e) => E$1(L.evaluationFact.byRule.$post, e),
+			orgSummary: (e = {}) => E$1(L.evaluationFact.orgSummary.$post, e),
+			projectSummary: (e) => E$1(L.evaluationFact.projectSummary.$post, e),
+			simulate: (e) => E$1(L.evaluationFact.simulate.$post, e)
 		},
-		snapshot: { publish: (e) => w$1(F.snapshot.publish.$post, e) },
-		device: { authorize: (e) => w$1(I.device.authorize.$post, e) },
+		snapshot: {
+			publish: (e) => E$1(R.snapshot.publish.$post, e),
+			listOutbox: (e = {}) => E$1(R.snapshot.outbox.list.$post, e),
+			listOutboxPage: (e = {}) => D$1(R.snapshot.outbox.list.$post, e),
+			requeue: (e) => E$1(R.snapshot.outbox.requeue.$post, e),
+			rebuild: (e) => E$1(R.snapshot.rebuild.$post, e),
+			listPublications: (e) => E$1(R.snapshot.publications.list.$post, e),
+			listPublicationsPage: (e) => D$1(R.snapshot.publications.list.$post, e)
+		},
+		device: { authorize: (e) => E$1(z.device.authorize.$post, e) },
 		billing: {
-			get: (e = {}) => w$1(L.billing.get.$post, e),
-			attach: (e) => w$1(L.billing.attach.$post, e),
-			openPortal: (e) => w$1(L.billing.openPortal.$post, e)
+			get: (e = {}) => E$1(B.billing.get.$post, e),
+			attach: (e) => E$1(B.billing.attach.$post, e),
+			openPortal: (e) => E$1(B.billing.openPortal.$post, e)
 		},
+		usage: { get: (e = {}) => E$1(V.usage.get.$post, e) },
 		approval: {
-			listPolicies: (e = {}) => w$1(O.approval.listPolicies.$post, e),
-			createPolicy: (e) => w$1(O.approval.createPolicy.$post, e),
-			updatePolicy: (e) => w$1(O.approval.updatePolicy.$post, e),
-			deletePolicy: (e) => w$1(O.approval.deletePolicy.$post, e),
-			listRequests: (e = {}) => w$1(O.approval.listRequests.$post, e),
-			get: (e) => w$1(O.approval.get.$post, e),
-			approve: (e) => w$1(O.approval.approve.$post, e),
-			reject: (e) => w$1(O.approval.reject.$post, e),
-			cancel: (e) => w$1(O.approval.cancel.$post, e)
+			listPolicies: (e = {}) => E$1(j.approval.listPolicies.$post, e),
+			createPolicy: (e) => E$1(j.approval.createPolicy.$post, e),
+			updatePolicy: (e) => E$1(j.approval.updatePolicy.$post, e),
+			deletePolicy: (e) => E$1(j.approval.deletePolicy.$post, e),
+			listRequests: (e = {}) => E$1(j.approval.listRequests.$post, e),
+			listRequestsPage: (e = {}) => D$1(j.approval.listRequests.$post, e),
+			get: (e) => E$1(j.approval.get.$post, e),
+			approve: (e) => E$1(j.approval.approve.$post, e),
+			reject: (e) => E$1(j.approval.reject.$post, e),
+			cancel: (e) => E$1(j.approval.cancel.$post, e)
 		},
 		audit: {
-			list: (e = {}) => w$1(k.audit.list.$post, e),
-			get: (e) => w$1(k.audit.get.$post, e),
-			actions: (e = {}) => w$1(k.audit.actions.$post, e),
-			export: (e) => w$1(k.audit.export.$post, e),
-			getSettings: (e = {}) => w$1(k.audit.getSettings.$post, e),
-			updateSettings: (e) => w$1(k.audit.updateSettings.$post, e),
-			listDestinations: (e = {}) => w$1(k.audit.listDestinations.$post, e),
-			createDestination: (e) => w$1(k.audit.createDestination.$post, e),
-			updateDestination: (e) => w$1(k.audit.updateDestination.$post, e),
-			deleteDestination: (e) => w$1(k.audit.deleteDestination.$post, e),
-			testDestination: (e) => w$1(k.audit.testDestination.$post, e)
+			list: (e = {}) => E$1(M.audit.list.$post, e),
+			get: (e) => E$1(M.audit.get.$post, e),
+			actions: (e = {}) => E$1(M.audit.actions.$post, e),
+			export: (e) => E$1(M.audit.export.$post, e),
+			getSettings: (e = {}) => E$1(M.audit.getSettings.$post, e),
+			updateSettings: (e) => E$1(M.audit.updateSettings.$post, e),
+			listDestinations: (e = {}) => E$1(M.audit.listDestinations.$post, e),
+			createDestination: (e) => E$1(M.audit.createDestination.$post, e),
+			updateDestination: (e) => E$1(M.audit.updateDestination.$post, e),
+			deleteDestination: (e) => E$1(M.audit.deleteDestination.$post, e),
+			testDestination: (e) => E$1(M.audit.testDestination.$post, e)
 		},
 		sso: {
-			getSettings: (e = {}) => w$1(z.sso.getSettings.$post, e),
-			listProviders: (e = {}) => w$1(z.sso.listProviders.$post, e),
-			updateAllowedDomains: (e) => w$1(z.sso.updateAllowedDomains.$post, e),
-			setEnforcement: (e) => w$1(z.sso.setEnforcement.$post, e)
+			getSettings: (e = {}) => E$1(U.sso.getSettings.$post, e),
+			listProviders: (e = {}) => E$1(U.sso.listProviders.$post, e),
+			updateAllowedDomains: (e) => E$1(U.sso.updateAllowedDomains.$post, e),
+			setEnforcement: (e) => E$1(U.sso.setEnforcement.$post, e),
+			setRequireTwoFactor: (e) => E$1(U.sso.setRequireTwoFactor.$post, e)
+		},
+		scim: {
+			getConnection: (e = {}) => E$1(W.scim.getConnection.$post, e),
+			createConnection: (e = { creationRequestId: crypto.randomUUID() }) => E$1(W.scim.createConnection.$post, e),
+			rotateCredential: (e) => E$1(W.scim.rotateCredential.$post, e),
+			revokeCredential: (e) => E$1(W.scim.revokeCredential.$post, e),
+			decommissionConnection: (e) => E$1(W.scim.decommissionConnection.$post, e)
 		},
 		raw: {
 			me: r,
 			project: i,
-			environment: T,
-			flag: E,
-			apiKey: D,
-			approval: O,
-			audit: k,
-			sdkKey: A,
-			serviceAccount: j,
-			segment: M,
-			evaluatedEntity: N,
-			evaluationFact: P,
-			snapshot: F,
-			device: I,
-			billing: L,
-			team: R,
-			sso: z
+			environment: O,
+			flag: k,
+			apiKey: A,
+			approval: j,
+			audit: M,
+			sdkKey: N,
+			serviceAccount: P,
+			segment: F,
+			evaluatedEntity: I,
+			evaluationFact: L,
+			snapshot: R,
+			device: z,
+			billing: B,
+			usage: V,
+			team: H,
+			sso: U,
+			scim: W
 		}
 	};
 }
@@ -671,7 +724,7 @@ var BetterAuthError = class extends Error {
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.7.1_@opentelemetry+api@1.9.1_drizzle-kit@1.0.0-rc.4_drizzle-orm@1.0.0-rc._0f4663e1f35d01509eefb20039600143/node_modules/better-auth/dist/plugins/access/access.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.7.1_@opentelemetry+api@1.9.1_drizzle-kit@1.0.0-rc.4_drizzle-orm@1.0.0-rc._29983ac85a08632d26ca60fb0be17581/node_modules/better-auth/dist/plugins/access/access.mjs
 function unknownResourceResponse(requestedResource) {
 	return {
 		success: false,
@@ -748,7 +801,7 @@ function createAccessControl(s) {
 }
 
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.7.1_@opentelemetry+api@1.9.1_drizzle-kit@1.0.0-rc.4_drizzle-orm@1.0.0-rc._0f4663e1f35d01509eefb20039600143/node_modules/better-auth/dist/plugins/two-factor/error-code.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.7.1_@opentelemetry+api@1.9.1_drizzle-kit@1.0.0-rc.4_drizzle-orm@1.0.0-rc._29983ac85a08632d26ca60fb0be17581/node_modules/better-auth/dist/plugins/two-factor/error-code.mjs
 const TWO_FACTOR_ERROR_CODES = defineErrorCodes({
 	OTP_NOT_ENABLED: "OTP not enabled",
 	OTP_NOT_CONFIGURED: "OTP is not available",
@@ -765,11 +818,11 @@ const TWO_FACTOR_ERROR_CODES = defineErrorCodes({
 });
 
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.7.1_@opentelemetry+api@1.9.1_drizzle-kit@1.0.0-rc.4_drizzle-orm@1.0.0-rc._0f4663e1f35d01509eefb20039600143/node_modules/better-auth/dist/package.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.7.1_@opentelemetry+api@1.9.1_drizzle-kit@1.0.0-rc.4_drizzle-orm@1.0.0-rc._29983ac85a08632d26ca60fb0be17581/node_modules/better-auth/dist/package.mjs
 var version = "1.7.1";
 
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.7.1_@opentelemetry+api@1.9.1_drizzle-kit@1.0.0-rc.4_drizzle-orm@1.0.0-rc._0f4663e1f35d01509eefb20039600143/node_modules/better-auth/dist/version.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.7.1_@opentelemetry+api@1.9.1_drizzle-kit@1.0.0-rc.4_drizzle-orm@1.0.0-rc._29983ac85a08632d26ca60fb0be17581/node_modules/better-auth/dist/version.mjs
 const PACKAGE_VERSION$3 = version;
 
 //#endregion
@@ -805,7 +858,7 @@ function isSafeUrlScheme(value) {
 }
 
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.7.1_@opentelemetry+api@1.9.1_drizzle-kit@1.0.0-rc.4_drizzle-orm@1.0.0-rc._0f4663e1f35d01509eefb20039600143/node_modules/better-auth/dist/plugins/two-factor/client.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.7.1_@opentelemetry+api@1.9.1_drizzle-kit@1.0.0-rc.4_drizzle-orm@1.0.0-rc._29983ac85a08632d26ca60fb0be17581/node_modules/better-auth/dist/plugins/two-factor/client.mjs
 const twoFactorClient = (options) => {
 	return {
 		id: "two-factor",
@@ -843,7 +896,7 @@ const twoFactorClient = (options) => {
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.7.1_@opentelemetry+api@1.9.1_drizzle-kit@1.0.0-rc.4_drizzle-orm@1.0.0-rc._0f4663e1f35d01509eefb20039600143/node_modules/better-auth/dist/plugins/admin/access/statement.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.7.1_@opentelemetry+api@1.9.1_drizzle-kit@1.0.0-rc.4_drizzle-orm@1.0.0-rc._29983ac85a08632d26ca60fb0be17581/node_modules/better-auth/dist/plugins/admin/access/statement.mjs
 const defaultStatements$1 = {
 	user: [
 		"create",
@@ -894,7 +947,7 @@ const defaultRoles$1 = {
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.7.1_@opentelemetry+api@1.9.1_drizzle-kit@1.0.0-rc.4_drizzle-orm@1.0.0-rc._0f4663e1f35d01509eefb20039600143/node_modules/better-auth/dist/plugins/admin/error-codes.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.7.1_@opentelemetry+api@1.9.1_drizzle-kit@1.0.0-rc.4_drizzle-orm@1.0.0-rc._29983ac85a08632d26ca60fb0be17581/node_modules/better-auth/dist/plugins/admin/error-codes.mjs
 const ADMIN_ERROR_CODES = defineErrorCodes({
 	FAILED_TO_CREATE_USER: "Failed to create user",
 	USER_ALREADY_EXISTS: "User already exists.",
@@ -986,7 +1039,7 @@ const ENV = Object.freeze({
 });
 
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.7.1_@opentelemetry+api@1.9.1_drizzle-kit@1.0.0-rc.4_drizzle-orm@1.0.0-rc._0f4663e1f35d01509eefb20039600143/node_modules/better-auth/dist/utils/url.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.7.1_@opentelemetry+api@1.9.1_drizzle-kit@1.0.0-rc.4_drizzle-orm@1.0.0-rc._29983ac85a08632d26ca60fb0be17581/node_modules/better-auth/dist/utils/url.mjs
 const SLASH_CHAR_CODE = "/".charCodeAt(0);
 function trimTrailingSlashes(value) {
 	let end = value.length;
@@ -1065,7 +1118,7 @@ function getOrigin(url) {
 }
 
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.7.1_@opentelemetry+api@1.9.1_drizzle-kit@1.0.0-rc.4_drizzle-orm@1.0.0-rc._0f4663e1f35d01509eefb20039600143/node_modules/better-auth/dist/plugins/admin/has-permission.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.7.1_@opentelemetry+api@1.9.1_drizzle-kit@1.0.0-rc.4_drizzle-orm@1.0.0-rc._29983ac85a08632d26ca60fb0be17581/node_modules/better-auth/dist/plugins/admin/has-permission.mjs
 const hasPermission = (input) => {
 	if (input.userId && input.options?.adminUserIds?.includes(input.userId)) return true;
 	if (!input.permissions) return false;
@@ -1594,7 +1647,7 @@ var betterFetch = async (url, options) => {
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.7.1_@opentelemetry+api@1.9.1_drizzle-kit@1.0.0-rc.4_drizzle-orm@1.0.0-rc._0f4663e1f35d01509eefb20039600143/node_modules/better-auth/dist/client/parser.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.7.1_@opentelemetry+api@1.9.1_drizzle-kit@1.0.0-rc.4_drizzle-orm@1.0.0-rc._29983ac85a08632d26ca60fb0be17581/node_modules/better-auth/dist/client/parser.mjs
 const PROTO_POLLUTION_PATTERNS = {
 	proto: /"(?:_|\\u0{2}5[Ff]){2}(?:p|\\u0{2}70)(?:r|\\u0{2}72)(?:o|\\u0{2}6[Ff])(?:t|\\u0{2}74)(?:o|\\u0{2}6[Ff])(?:_|\\u0{2}5[Ff]){2}"\s*:/,
 	constructor: /"(?:c|\\u0063)(?:o|\\u006[Ff])(?:n|\\u006[Ee])(?:s|\\u0073)(?:t|\\u0074)(?:r|\\u0072)(?:u|\\u0075)(?:c|\\u0063)(?:t|\\u0074)(?:o|\\u006[Ff])(?:r|\\u0072)"\s*:/,
@@ -1664,7 +1717,7 @@ function parseJSON(value, options = { strict: true }) {
 }
 
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.7.1_@opentelemetry+api@1.9.1_drizzle-kit@1.0.0-rc.4_drizzle-orm@1.0.0-rc._0f4663e1f35d01509eefb20039600143/node_modules/better-auth/dist/plugins/organization/access/statement.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.7.1_@opentelemetry+api@1.9.1_drizzle-kit@1.0.0-rc.4_drizzle-orm@1.0.0-rc._29983ac85a08632d26ca60fb0be17581/node_modules/better-auth/dist/plugins/organization/access/statement.mjs
 const defaultStatements = {
 	organization: ["update", "delete"],
 	member: [
@@ -1740,7 +1793,7 @@ const defaultRoles = {
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.7.1_@opentelemetry+api@1.9.1_drizzle-kit@1.0.0-rc.4_drizzle-orm@1.0.0-rc._0f4663e1f35d01509eefb20039600143/node_modules/better-auth/dist/plugins/organization/permission.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.7.1_@opentelemetry+api@1.9.1_drizzle-kit@1.0.0-rc.4_drizzle-orm@1.0.0-rc._29983ac85a08632d26ca60fb0be17581/node_modules/better-auth/dist/plugins/organization/permission.mjs
 const hasPermissionFn = (input, acRoles) => {
 	if (!input.permissions) return false;
 	const roles = input.role.split(",");
@@ -1753,7 +1806,7 @@ const hasPermissionFn = (input, acRoles) => {
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.7.1_@opentelemetry+api@1.9.1_drizzle-kit@1.0.0-rc.4_drizzle-orm@1.0.0-rc._0f4663e1f35d01509eefb20039600143/node_modules/better-auth/dist/plugins/organization/error-codes.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.7.1_@opentelemetry+api@1.9.1_drizzle-kit@1.0.0-rc.4_drizzle-orm@1.0.0-rc._29983ac85a08632d26ca60fb0be17581/node_modules/better-auth/dist/plugins/organization/error-codes.mjs
 const ORGANIZATION_ERROR_CODES = defineErrorCodes({
 	YOU_ARE_NOT_ALLOWED_TO_CREATE_A_NEW_ORGANIZATION: "You are not allowed to create a new organization",
 	YOU_HAVE_REACHED_THE_MAXIMUM_NUMBER_OF_ORGANIZATIONS: "You have reached the maximum number of organizations",
@@ -1834,8 +1887,12 @@ const t$1 = createAccessControl({
 		`delete`
 	],
 	audit: [`read`],
-	approval_policy: [`update`],
-	approval_request: [`review`],
+	approval_policy: [`read`, `update`],
+	approval_request: [
+		`read`,
+		`review`,
+		`cancel`
+	],
 	project: [
 		`create`,
 		`read`,
@@ -1869,6 +1926,7 @@ const t$1 = createAccessControl({
 		`revoke`
 	],
 	evaluated_entity: [`read`, `delete`],
+	snapshot: [`read`],
 	billing: [`read`, `manage`],
 	sso: [
 		`read`,
@@ -1896,7 +1954,9 @@ const n$1 = {
 		environment: [`read`],
 		flag: [`read`],
 		evaluated_entity: [`read`],
-		billing: [`read`]
+		billing: [`read`],
+		approval_policy: [`read`],
+		approval_request: [`read`]
 	}),
 	editor: t$1.newRole({
 		member: [`read`],
@@ -1917,14 +1977,17 @@ const n$1 = {
 			`revoke`
 		],
 		evaluated_entity: [`read`],
-		billing: [`read`]
+		billing: [`read`],
+		approval_policy: [`read`],
+		approval_request: [`read`]
 	}),
 	admin: t$1.newRole({
 		organization: [`update`],
 		member: [
 			`create`,
 			`read`,
-			`update`
+			`update`,
+			`delete`
 		],
 		invitation: [`create`, `cancel`],
 		team: [
@@ -1934,8 +1997,12 @@ const n$1 = {
 			`delete`
 		],
 		audit: [`read`],
-		approval_policy: [`update`],
-		approval_request: [`review`],
+		approval_policy: [`read`, `update`],
+		approval_request: [
+			`read`,
+			`review`,
+			`cancel`
+		],
 		project: [
 			`create`,
 			`read`,
@@ -1969,6 +2036,7 @@ const n$1 = {
 			`revoke`
 		],
 		evaluated_entity: [`read`, `delete`],
+		snapshot: [`read`],
 		billing: [`read`, `manage`],
 		sso: [`read`, `manage`],
 		service_account: [
@@ -2000,8 +2068,12 @@ const n$1 = {
 			`delete`
 		],
 		audit: [`read`],
-		approval_policy: [`update`],
-		approval_request: [`review`],
+		approval_policy: [`read`, `update`],
+		approval_request: [
+			`read`,
+			`review`,
+			`cancel`
+		],
 		project: [
 			`create`,
 			`read`,
@@ -2035,6 +2107,7 @@ const n$1 = {
 			`revoke`
 		],
 		evaluated_entity: [`read`, `delete`],
+		snapshot: [`read`],
 		billing: [`read`, `manage`],
 		sso: [
 			`read`,
@@ -2057,7 +2130,7 @@ const n$1 = {
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.7.1_@opentelemetry+api@1.9.1_drizzle-kit@1.0.0-rc.4_drizzle-orm@1.0.0-rc._0f4663e1f35d01509eefb20039600143/node_modules/better-auth/dist/client/broadcast-channel.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.7.1_@opentelemetry+api@1.9.1_drizzle-kit@1.0.0-rc.4_drizzle-orm@1.0.0-rc._29983ac85a08632d26ca60fb0be17581/node_modules/better-auth/dist/client/broadcast-channel.mjs
 const kBroadcastChannel = Symbol.for("better-auth:broadcast-channel");
 const now$1 = () => Math.floor(Date.now() / 1e3);
 var WindowBroadcastChannel = class {
@@ -2281,7 +2354,7 @@ let onMount = ($store, initialize) => {
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.7.1_@opentelemetry+api@1.9.1_drizzle-kit@1.0.0-rc.4_drizzle-orm@1.0.0-rc._0f4663e1f35d01509eefb20039600143/node_modules/better-auth/dist/client/equality.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.7.1_@opentelemetry+api@1.9.1_drizzle-kit@1.0.0-rc.4_drizzle-orm@1.0.0-rc._29983ac85a08632d26ca60fb0be17581/node_modules/better-auth/dist/client/equality.mjs
 function isPlainObject(value) {
 	if (typeof value !== "object" || value === null) return false;
 	const prototype = Object.getPrototypeOf(value);
@@ -2322,7 +2395,7 @@ function withEquality(store, isEqual) {
 }
 
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.7.1_@opentelemetry+api@1.9.1_drizzle-kit@1.0.0-rc.4_drizzle-orm@1.0.0-rc._0f4663e1f35d01509eefb20039600143/node_modules/better-auth/dist/client/focus-manager.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.7.1_@opentelemetry+api@1.9.1_drizzle-kit@1.0.0-rc.4_drizzle-orm@1.0.0-rc._29983ac85a08632d26ca60fb0be17581/node_modules/better-auth/dist/client/focus-manager.mjs
 const kFocusManager = Symbol.for("better-auth:focus-manager");
 var WindowFocusManager = class {
 	listeners = /* @__PURE__ */ new Set();
@@ -2352,7 +2425,7 @@ function getGlobalFocusManager() {
 }
 
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.7.1_@opentelemetry+api@1.9.1_drizzle-kit@1.0.0-rc.4_drizzle-orm@1.0.0-rc._0f4663e1f35d01509eefb20039600143/node_modules/better-auth/dist/client/online-manager.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.7.1_@opentelemetry+api@1.9.1_drizzle-kit@1.0.0-rc.4_drizzle-orm@1.0.0-rc._29983ac85a08632d26ca60fb0be17581/node_modules/better-auth/dist/client/online-manager.mjs
 const kOnlineManager = Symbol.for("better-auth:online-manager");
 var WindowOnlineManager = class {
 	listeners = /* @__PURE__ */ new Set();
@@ -2385,7 +2458,7 @@ function getGlobalOnlineManager() {
 }
 
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.7.1_@opentelemetry+api@1.9.1_drizzle-kit@1.0.0-rc.4_drizzle-orm@1.0.0-rc._0f4663e1f35d01509eefb20039600143/node_modules/better-auth/dist/client/query.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.7.1_@opentelemetry+api@1.9.1_drizzle-kit@1.0.0-rc.4_drizzle-orm@1.0.0-rc._29983ac85a08632d26ca60fb0be17581/node_modules/better-auth/dist/client/query.mjs
 const isServer$1 = () => typeof window === "undefined";
 function isAuthQueryStateEqual(a, b) {
 	return isJsonEqual(a.data, b.data) && a.error === b.error && a.isPending === b.isPending && a.isRefetching === b.isRefetching && a.refetch === b.refetch;
@@ -2507,7 +2580,7 @@ const useAuthQuery = (initializedAtom, path, $fetch, options) => {
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.7.1_@opentelemetry+api@1.9.1_drizzle-kit@1.0.0-rc.4_drizzle-orm@1.0.0-rc._0f4663e1f35d01509eefb20039600143/node_modules/better-auth/dist/client/session-refresh.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.7.1_@opentelemetry+api@1.9.1_drizzle-kit@1.0.0-rc.4_drizzle-orm@1.0.0-rc._29983ac85a08632d26ca60fb0be17581/node_modules/better-auth/dist/client/session-refresh.mjs
 const now = () => Math.floor(Date.now() / 1e3);
 /**
 * Rate limit: don't refetch on focus if a session request was made within this many seconds
@@ -2635,7 +2708,7 @@ function createSessionRefreshManager(opts) {
 }
 
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.7.1_@opentelemetry+api@1.9.1_drizzle-kit@1.0.0-rc.4_drizzle-orm@1.0.0-rc._0f4663e1f35d01509eefb20039600143/node_modules/better-auth/dist/client/fetch-plugins.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.7.1_@opentelemetry+api@1.9.1_drizzle-kit@1.0.0-rc.4_drizzle-orm@1.0.0-rc._29983ac85a08632d26ca60fb0be17581/node_modules/better-auth/dist/client/fetch-plugins.mjs
 const redirectPlugin = {
 	id: "redirect",
 	name: "Redirect",
@@ -2651,7 +2724,7 @@ const redirectPlugin = {
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.7.1_@opentelemetry+api@1.9.1_drizzle-kit@1.0.0-rc.4_drizzle-orm@1.0.0-rc._0f4663e1f35d01509eefb20039600143/node_modules/better-auth/dist/client/session-atom.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.7.1_@opentelemetry+api@1.9.1_drizzle-kit@1.0.0-rc.4_drizzle-orm@1.0.0-rc._29983ac85a08632d26ca60fb0be17581/node_modules/better-auth/dist/client/session-atom.mjs
 const isServer = () => typeof window === "undefined";
 const SESSION_MOUNT_DEDUPE_INTERVAL = STORE_UNMOUNT_DELAY;
 function hydrateSessionAtom(sessionAtom, session) {
@@ -2826,7 +2899,7 @@ function getSessionAtom($fetch, options) {
 }
 
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.7.1_@opentelemetry+api@1.9.1_drizzle-kit@1.0.0-rc.4_drizzle-orm@1.0.0-rc._0f4663e1f35d01509eefb20039600143/node_modules/better-auth/dist/client/config.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.7.1_@opentelemetry+api@1.9.1_drizzle-kit@1.0.0-rc.4_drizzle-orm@1.0.0-rc._29983ac85a08632d26ca60fb0be17581/node_modules/better-auth/dist/client/config.mjs
 const resolvePublicAuthUrl = (basePath) => {
 	if (typeof process === "undefined") return void 0;
 	const path = basePath ?? "/api/auth";
@@ -2932,7 +3005,7 @@ const getClientConfig = (options, loadEnv) => {
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.7.1_@opentelemetry+api@1.9.1_drizzle-kit@1.0.0-rc.4_drizzle-orm@1.0.0-rc._0f4663e1f35d01509eefb20039600143/node_modules/better-auth/dist/utils/is-atom.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.7.1_@opentelemetry+api@1.9.1_drizzle-kit@1.0.0-rc.4_drizzle-orm@1.0.0-rc._29983ac85a08632d26ca60fb0be17581/node_modules/better-auth/dist/utils/is-atom.mjs
 function isAtom(value) {
 	return typeof value === "object" && value !== null && "get" in value && typeof value.get === "function" && "lc" in value && typeof value.lc === "number";
 }
@@ -2952,7 +3025,7 @@ function toKebabCase(input) {
 }
 
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.7.1_@opentelemetry+api@1.9.1_drizzle-kit@1.0.0-rc.4_drizzle-orm@1.0.0-rc._0f4663e1f35d01509eefb20039600143/node_modules/better-auth/dist/client/proxy.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.7.1_@opentelemetry+api@1.9.1_drizzle-kit@1.0.0-rc.4_drizzle-orm@1.0.0-rc._29983ac85a08632d26ca60fb0be17581/node_modules/better-auth/dist/client/proxy.mjs
 function getMethod(path, knownPathMethods, args) {
 	const method = knownPathMethods[path];
 	const { fetchOptions, query: _query, ...body } = args || {};
@@ -3028,7 +3101,7 @@ function createDynamicPathProxy(routes, client, knownPathMethods, atoms, atomLis
 }
 
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.7.1_@opentelemetry+api@1.9.1_drizzle-kit@1.0.0-rc.4_drizzle-orm@1.0.0-rc._0f4663e1f35d01509eefb20039600143/node_modules/better-auth/dist/client/vanilla.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.7.1_@opentelemetry+api@1.9.1_drizzle-kit@1.0.0-rc.4_drizzle-orm@1.0.0-rc._29983ac85a08632d26ca60fb0be17581/node_modules/better-auth/dist/client/vanilla.mjs
 function createAuthClient(options) {
 	const { pluginPathMethods, pluginsActions, pluginsAtoms, hydrateSession, $fetch, atomListeners, $store } = getClientConfig(options);
 	const resolvedHooks = {};
@@ -3043,7 +3116,7 @@ function createAuthClient(options) {
 }
 
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.7.1_@opentelemetry+api@1.9.1_drizzle-kit@1.0.0-rc.4_drizzle-orm@1.0.0-rc._0f4663e1f35d01509eefb20039600143/node_modules/better-auth/dist/plugins/additional-fields/client.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.7.1_@opentelemetry+api@1.9.1_drizzle-kit@1.0.0-rc.4_drizzle-orm@1.0.0-rc._29983ac85a08632d26ca60fb0be17581/node_modules/better-auth/dist/plugins/additional-fields/client.mjs
 const inferAdditionalFields = (schema) => {
 	return {
 		id: "additional-fields-client",
@@ -3053,7 +3126,7 @@ const inferAdditionalFields = (schema) => {
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.7.1_@opentelemetry+api@1.9.1_drizzle-kit@1.0.0-rc.4_drizzle-orm@1.0.0-rc._0f4663e1f35d01509eefb20039600143/node_modules/better-auth/dist/plugins/admin/client.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.7.1_@opentelemetry+api@1.9.1_drizzle-kit@1.0.0-rc.4_drizzle-orm@1.0.0-rc._29983ac85a08632d26ca60fb0be17581/node_modules/better-auth/dist/plugins/admin/client.mjs
 const adminClient = (options) => {
 	const roles = {
 		admin: adminAc$1,
@@ -3088,7 +3161,7 @@ const adminClient = (options) => {
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.7.1_@opentelemetry+api@1.9.1_drizzle-kit@1.0.0-rc.4_drizzle-orm@1.0.0-rc._0f4663e1f35d01509eefb20039600143/node_modules/better-auth/dist/plugins/device-authorization/client.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.7.1_@opentelemetry+api@1.9.1_drizzle-kit@1.0.0-rc.4_drizzle-orm@1.0.0-rc._29983ac85a08632d26ca60fb0be17581/node_modules/better-auth/dist/plugins/device-authorization/client.mjs
 const deviceAuthorizationClient = () => {
 	return {
 		id: "device-authorization",
@@ -3105,7 +3178,7 @@ const deviceAuthorizationClient = () => {
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/better-auth@1.7.1_@opentelemetry+api@1.9.1_drizzle-kit@1.0.0-rc.4_drizzle-orm@1.0.0-rc._0f4663e1f35d01509eefb20039600143/node_modules/better-auth/dist/plugins/organization/client.mjs
+//#region ../../node_modules/.pnpm/better-auth@1.7.1_@opentelemetry+api@1.9.1_drizzle-kit@1.0.0-rc.4_drizzle-orm@1.0.0-rc._29983ac85a08632d26ca60fb0be17581/node_modules/better-auth/dist/plugins/organization/client.mjs
 /**
 * Using the same `hasPermissionFn` function, but without the need for a `ctx` parameter or the `organizationId` parameter.
 */
@@ -3200,7 +3273,7 @@ const organizationClient = (options) => {
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@better-auth+api-key@1.7.1_@better-auth+core@1.7.1_@better-auth+utils@0.4.2_@better-fet_2568c45b7ee73e55b396faf3d8bd3e1a/node_modules/@better-auth/api-key/dist/version-D365O1mH.mjs
+//#region ../../node_modules/.pnpm/@better-auth+api-key@1.7.1_@better-auth+core@1.7.1_@better-auth+utils@0.4.2_@better-fet_a4fe5759ddb57f435137bfe015134721/node_modules/@better-auth/api-key/dist/version-D365O1mH.mjs
 const API_KEY_ERROR_CODES = defineErrorCodes({
 	INVALID_METADATA_TYPE: "metadata must be an object or undefined",
 	REFILL_AMOUNT_AND_INTERVAL_REQUIRED: "refillAmount is required when refillInterval is provided",
@@ -3237,7 +3310,7 @@ const API_KEY_ERROR_CODES = defineErrorCodes({
 const PACKAGE_VERSION$2 = "1.7.1";
 
 //#endregion
-//#region ../../node_modules/.pnpm/@better-auth+api-key@1.7.1_@better-auth+core@1.7.1_@better-auth+utils@0.4.2_@better-fet_2568c45b7ee73e55b396faf3d8bd3e1a/node_modules/@better-auth/api-key/dist/client.mjs
+//#region ../../node_modules/.pnpm/@better-auth+api-key@1.7.1_@better-auth+core@1.7.1_@better-auth+utils@0.4.2_@better-fet_a4fe5759ddb57f435137bfe015134721/node_modules/@better-auth/api-key/dist/client.mjs
 const apiKeyClient = () => {
 	return {
 		id: "api-key",
@@ -3253,7 +3326,7 @@ const apiKeyClient = () => {
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@better-auth+passkey@1.7.1_@better-auth+core@1.7.1_@better-auth+utils@0.4.2_@better-fet_3e5015565ab35cd7b806fd7cb64ff2ec/node_modules/@better-auth/passkey/dist/version-CNE1I0BY.mjs
+//#region ../../node_modules/.pnpm/@better-auth+passkey@1.7.1_@better-auth+core@1.7.1_@better-auth+utils@0.4.2_@better-fet_670374e089e097efe27e0c3a48cf5b4e/node_modules/@better-auth/passkey/dist/version-CNE1I0BY.mjs
 const PASSKEY_ERROR_CODES = defineErrorCodes({
 	CHALLENGE_NOT_FOUND: "Challenge not found",
 	YOU_ARE_NOT_ALLOWED_TO_REGISTER_THIS_PASSKEY: "You are not allowed to register this passkey",
@@ -3743,7 +3816,7 @@ async function startAuthentication(options) {
 }
 
 //#endregion
-//#region ../../node_modules/.pnpm/@better-auth+passkey@1.7.1_@better-auth+core@1.7.1_@better-auth+utils@0.4.2_@better-fet_3e5015565ab35cd7b806fd7cb64ff2ec/node_modules/@better-auth/passkey/dist/client.mjs
+//#region ../../node_modules/.pnpm/@better-auth+passkey@1.7.1_@better-auth+core@1.7.1_@better-auth+utils@0.4.2_@better-fet_670374e089e097efe27e0c3a48cf5b4e/node_modules/@better-auth/passkey/dist/client.mjs
 const getPasskeyActions = ($fetch, { $listPasskeys, $store }) => {
 	const signInPasskey = async (opts, options) => {
 		const response = await $fetch("/passkey/generate-authenticate-options", {
@@ -3945,11 +4018,11 @@ const passkeyClient = () => {
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@better-auth+sso@1.7.1_@better-auth+core@1.7.1_@better-auth+utils@0.4.2_@better-fetch+f_ab392d2d19ca264106fdcee67033c1f1/node_modules/@better-auth/sso/dist/version-BbG1DbY-.mjs
+//#region ../../node_modules/.pnpm/@better-auth+sso@1.7.1_@better-auth+core@1.7.1_@better-auth+utils@0.4.2_@better-fetch+f_f113731728b549e501373576d6a425b0/node_modules/@better-auth/sso/dist/version-BbG1DbY-.mjs
 const PACKAGE_VERSION = "1.7.1";
 
 //#endregion
-//#region ../../node_modules/.pnpm/@better-auth+sso@1.7.1_@better-auth+core@1.7.1_@better-auth+utils@0.4.2_@better-fetch+f_ab392d2d19ca264106fdcee67033c1f1/node_modules/@better-auth/sso/dist/client.mjs
+//#region ../../node_modules/.pnpm/@better-auth+sso@1.7.1_@better-auth+core@1.7.1_@better-auth+utils@0.4.2_@better-fetch+f_f113731728b549e501373576d6a425b0/node_modules/@better-auth/sso/dist/client.mjs
 const ssoClient = (options) => {
 	return {
 		id: "sso-client",
@@ -4086,7 +4159,7 @@ async function createCliApiClient(runtime) {
 		sessionToken,
 		orgSlug: runtime.org
 	});
-	const client = T$1({
+	const client = O$1({
 		baseUrl: runtime.apiUrl,
 		client: "cli",
 		getHeaders: () => {
@@ -4542,7 +4615,7 @@ function V(e, t) {
 const H = z.object({
 	projectId: z.string().min(1),
 	environmentId: z.string().min(1),
-	flags: z.array(I)
+	flags: z.array(I).max(500)
 }).superRefine((e, t) => V(e.flags, t));
 const U = z.object({
 	key: z.string(),
@@ -4565,7 +4638,7 @@ const W = z.object({
 const G = z.object({
 	projectId: z.string().min(1),
 	environmentId: z.string().min(1),
-	flags: z.array(I),
+	flags: z.array(I).max(500),
 	apply: z.boolean().default(!1),
 	prune: z.boolean().default(!1),
 	force: z.boolean().default(!1),
@@ -5076,6 +5149,7 @@ function registerPushCommand(program) {
 			remoteOnly,
 			forced: applied.forced === true,
 			approvalRequests,
+			outcome: approvalRequests.length > 0 ? "pending_approval" : "applied",
 			types
 		}, [
 			applied.changes.length > 0 ? `Applied ${applied.changes.length} change(s).` : null,
@@ -5083,13 +5157,15 @@ function registerPushCommand(program) {
 			applied.forced ? "Forced through version conflicts (audited)." : null,
 			`Wrote types for ${types.flagCount} flag(s) to ${types.written}`
 		].filter(Boolean).join("\n"));
+		if (approvalRequests.length > 0) process.exitCode = 5;
 	});
 }
 
 //#endregion
 //#region src/commands/snapshots.ts
 function registerSnapshotsCommands(program) {
-	program.command("snapshots").description("Data-plane snapshot operations").command("publish").description("Materialize the environment snapshot from Postgres and publish to the data plane").action(async (_opts, command) => {
+	const snapshots = program.command("snapshots").description("Data-plane snapshot operations");
+	snapshots.command("publish").description("Materialize the environment snapshot from Postgres and publish to the data plane").action(async (_opts, command) => {
 		const runtime = getRuntime(command);
 		const client = await createCliApiClient(runtime);
 		const { environmentId } = await resolveIds(client, runtime);
@@ -5100,6 +5176,62 @@ function registerSnapshotsCommands(program) {
 		}
 		console.log(`Published ${result.environmentKey} v${result.version} (${result.flagCount} flags) → ${result.keys.current}`);
 	});
+	snapshots.command("outbox").description("List snapshot outbox rows").option("--status <status>", "Filter by status (pending, failed, dead_lettered, …)").action(async (opts, command) => {
+		const runtime = getRuntime(command);
+		const client = await createCliApiClient(runtime);
+		const { environmentId } = await resolveIds(client, runtime);
+		const result = await client.snapshot.listOutbox({
+			environmentId,
+			status: opts.status
+		}).catch(mapApiError);
+		if (runtime.json) {
+			console.log(JSON.stringify(result, null, 2));
+			return;
+		}
+		const rows = Array.isArray(result) ? result : [];
+		if (rows.length === 0) {
+			console.log("No outbox rows.");
+			return;
+		}
+		for (const row of rows) console.log(`#${row.id} v${row.snapshotVersion} ${row.status} attempts=${row.attempts}${row.lastError ? ` — ${row.lastError}` : ""}`);
+	});
+	snapshots.command("requeue").description("Requeue dead-lettered snapshot outbox rows for this environment").action(async (_opts, command) => {
+		const runtime = getRuntime(command);
+		const client = await createCliApiClient(runtime);
+		const { environmentId } = await resolveIds(client, runtime);
+		const result = await client.snapshot.requeue({ environmentId }).catch(mapApiError);
+		if (runtime.json) {
+			console.log(JSON.stringify(result, null, 2));
+			return;
+		}
+		console.log(`Requeued ${result.requeued} dead-lettered row(s).`);
+	});
+	snapshots.command("rebuild").description("Enqueue a snapshot rebuild from Postgres (does not bump version)").option("--project", "Rebuild every environment in the current project").action(async (opts, command) => {
+		const runtime = getRuntime(command);
+		const client = await createCliApiClient(runtime);
+		const result = await (opts.project ? resolveProjectId(client, runtime).then(({ projectId }) => client.snapshot.rebuild({ projectId })) : resolveIds(client, runtime).then(({ environmentId }) => client.snapshot.rebuild({ environmentId }))).catch(mapApiError);
+		if (runtime.json) {
+			console.log(JSON.stringify(result, null, 2));
+			return;
+		}
+		console.log(`Enqueued ${result.enqueued} rebuild job(s).`);
+	});
+	snapshots.command("publications").description("List recorded snapshot publications for this environment").action(async (_opts, command) => {
+		const runtime = getRuntime(command);
+		const client = await createCliApiClient(runtime);
+		const { environmentId } = await resolveIds(client, runtime);
+		const result = await client.snapshot.listPublications({ environmentId }).catch(mapApiError);
+		if (runtime.json) {
+			console.log(JSON.stringify(result, null, 2));
+			return;
+		}
+		const rows = Array.isArray(result) ? result : [];
+		if (rows.length === 0) {
+			console.log("No publications.");
+			return;
+		}
+		for (const row of rows) console.log(`#${row.id} v${row.snapshotVersion} notify=${row.notifyStatus} ${row.contentHash.slice(0, 12)} ${row.createdAt}`);
+	});
 }
 
 //#endregion

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shipdit/cli",
-  "version": "0.2.2",
+  "version": "0.3.1",
   "description": "shipd's command-line interface",
   "repository": {
     "type": "git",
@@ -19,7 +19,7 @@
   "dependencies": {
     "commander": "^14.0.0",
     "jiti": "^2.5.1",
-    "shipdit": "0.2.3",
+    "shipdit": "0.2.4",
     "zod": "^4"
   },
   "devDependencies": {