permdock 0.10.0 → 0.11.0

package/dist/{adoption-scan-0oFt2RD5.js → adoption-scan-DKCOsfcF.js}

@@ -1,5 +1,5 @@
 import { r as listSourceFiles } from "./files-BSjrtIHw.js";
-import { t as DOCS_BASE } from "./manifest-B4ENCp2I.js";
+import { t as DOCS_BASE } from "./manifest-Cav1rjNQ.js";
 import { readFileSync } from "node:fs";
 import { relative } from "node:path";
 //#region src/cli/adoption-scan.ts

package/dist/{arazzo-DA9PCXew.js → arazzo-BXaEhGHM.js}

@@ -21,7 +21,7 @@ const check = defineLeaf({
 		...permissionsFlag
 	},
 	async run(ctx, { flags }) {
-		return (await import("./arazzo-DhxDfYt-.js")).runArazzo({
+		return (await import("./arazzo-CTH5iN--.js")).runArazzo({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			doc: given(flags.doc),

package/dist/{arazzo-DhxDfYt-.js → arazzo-CTH5iN--.js}

@@ -3,7 +3,7 @@ import { c as missingInput } from "./errors-Vpu6rKHl.js";
 import { i as readJsonFile } from "./files-BSjrtIHw.js";
 import { t as ARAZZO_REPORT_SCHEMA } from "./version-DMQ0dnN5.js";
 import { a as loadModule, s as pickNamed, t as asPermissionTree } from "./load-DjSU5KXO.js";
-import { t as DOCS_BASE } from "./manifest-B4ENCp2I.js";
+import { t as DOCS_BASE } from "./manifest-Cav1rjNQ.js";
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 //#region src/cli/arazzo.ts

package/dist/{casbin-BkhqGh2z.js → casbin-BuTZnSPv.js}

@@ -16,7 +16,7 @@ const casbinImport = defineLeaf({
 		...outFlag
 	},
 	async run(ctx, { flags }) {
-		const { runCasbinImport } = await import("./casbin-BJu2liqU.js");
+		const { runCasbinImport } = await import("./casbin-DTi6HSsl.js");
 		return runCasbinImport({
 			cwd: ctx.cwd,
 			model: given(flags.model),

package/dist/{casbin-BJu2liqU.js → casbin-DTi6HSsl.js}

@@ -1,4 +1,4 @@
-import { a as nonEmptyOr } from "./output-LsbLe41I.js";
+import { a as nonEmptyOr } from "./output-CtyBwTNB.js";
 import { t as applyFiles } from "./files-B3AA05f1.js";
 import { n as isIdentifier, t as emitPolicyModule } from "./policy-module-xym9fnSq.js";
 import { existsSync, readFileSync } from "node:fs";

package/dist/cli/bin.js

@@ -11,7 +11,7 @@ if (argv.length === 1 && (argv[0] === "--version" || argv[0] === "-v")) {
 	const [{ isCi }, { trapSignals }, { run }, { streamHasColors }] = await Promise.all([
 		import("../env-DJZrPjRi.js"),
 		import("../signals-B1vHR3fN.js"),
-		import("../run-BATawNVH.js"),
+		import("../run-0vOholnN.js"),
 		import("../style-DblOtSga.js")
 	]);
 	const signals = trapSignals();

package/dist/cli/index.js

@@ -2,7 +2,7 @@ import { t as catalogPath } from "../catalog-path-CnI0XTFK.js";
 import { t as defineConfig } from "../config-BR23fL8m.js";
 import { n as parsePushedPolicy, r as pushedPolicy, t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-CDuOL2de.js";
 import { c as parseGrantsMarker, l as parseHookMarker } from "../markers-BeHZ4x9Q.js";
-import { t as run } from "../run-CLP_fQUF.js";
+import { t as run } from "../run-B5nyNKe8.js";
 //#region src/cli/token-schemas.ts
 const ID = {
 	type: "string",

package/dist/{cloud-3RIuS4E9.js → cloud-DiAiYFRo.js}

@@ -70,7 +70,7 @@ const pull = defineLeaf({
 	},
 	async run(ctx, { flags }) {
 		const env = await withStdinSecret(ctx, "token", flags["token-stdin"], "PERMDOCK_CLOUD_TOKEN");
-		return (await import("./pull-DYbyod1f.js")).runCloudPull({
+		return (await import("./pull-DfJALUbS.js")).runCloudPull({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			url: given(flags.url),

package/dist/{codemod-DRl_w-bY.js → codemod-C1U8_Zu3.js}

@@ -1,7 +1,7 @@
 import { n as CliError } from "./errors-Vpu6rKHl.js";
 import { a as rel } from "./files-BSjrtIHw.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
-import { n as ROOT } from "./manifest-B4ENCp2I.js";
+import { n as ROOT } from "./manifest-Cav1rjNQ.js";
 import { i as renameMessage, n as DEFAULT_CHANGES, r as flagRename, t as COMMAND_MOVES } from "./renames-CGj7YwcQ.js";
 import { i as refuseDirty, t as applyFiles } from "./files-B3AA05f1.js";
 import { readFileSync, readdirSync, statSync } from "node:fs";

package/dist/{codemod-DLcp-B6v.js → codemod-_q_ZI01S.js}

@@ -7,7 +7,7 @@ const codemod = defineLeaf({
 		description: "The release to migrate to (0.5)",
 		required: true,
 		async complete() {
-			return (await import("./codemod-DRl_w-bY.js")).codemodVersions();
+			return (await import("./codemod-C1U8_Zu3.js")).codemodVersions();
 		}
 	}, {
 		name: "paths",
@@ -22,7 +22,7 @@ const codemod = defineLeaf({
 		}
 	},
 	async run(ctx, { flags, args, rest }) {
-		return (await import("./codemod-DRl_w-bY.js")).runCodemod({
+		return (await import("./codemod-C1U8_Zu3.js")).runCodemod({
 			cwd: ctx.cwd,
 			version: args["version"],
 			paths: rest,

package/dist/{completion-VSWvaaPO.js → completion-DLTuCf53.js}

@@ -1,6 +1,6 @@
 import { n as CliError } from "./errors-Vpu6rKHl.js";
 import { a as suggestion, o as GLOBAL_FLAGS } from "./args-0FrVs5EH.js";
-import { a as resolve } from "./manifest-B4ENCp2I.js";
+import { a as resolve } from "./manifest-Cav1rjNQ.js";
 import { t as defineLeaf } from "./command-L8EstFNm.js";
 //#region src/cli/core/completion.ts
 const SHELLS = [

package/dist/{config-kL36AxkE.js → config-CmydKZr2.js}

@@ -10,7 +10,7 @@ const config = defineLeaf({
 		...failOnFlag
 	},
 	async run(ctx, { flags }) {
-		const { runConfig } = await import("./config-report-osnfUNg5.js");
+		const { runConfig } = await import("./config-report-5AwptLr2.js");
 		return runConfig({
 			cwd: ctx.cwd,
 			config: ctx.config,

package/dist/{config-report-osnfUNg5.js → config-report-5AwptLr2.js}

@@ -3,7 +3,7 @@ import { r as CONFIG_REPORT_SCHEMA } from "./version-DMQ0dnN5.js";
 import { t as catalogPath } from "./catalog-path-CnI0XTFK.js";
 import { n as guessPermissions, t as barrelFile } from "./collect-WCl8cJQV.js";
 import "./sources-C4vkzZJV.js";
-import { t as DOCS_BASE } from "./manifest-B4ENCp2I.js";
+import { t as DOCS_BASE } from "./manifest-Cav1rjNQ.js";
 import { n as MIGRATION_DIRS, t as DEFAULT_SENSITIVE_ACTIONS } from "./constants-DcJABbLW.js";
 //#region src/cli/config-report.ts
 function configReport(input) {

package/dist/{doctor-B9FY9H0F.js → doctor-DxyVeUEE.js}

@@ -10,7 +10,7 @@ const doctor = defineLeaf({
 			description: "Check codes or groups to run",
 			valueHint: "code",
 			async complete() {
-				const { DOCTOR_CHECKS } = await import("./doctor-DfTnMaUt.js");
+				const { DOCTOR_CHECKS } = await import("./doctor-ktitU5Dl.js");
 				return [.../* @__PURE__ */ new Set([...DOCTOR_CHECKS.map(({ code }) => code), ...DOCTOR_CHECKS.flatMap(({ groups }) => groups)])];
 			}
 		},
@@ -27,7 +27,7 @@ const doctor = defineLeaf({
 			if (answer === void 0) return CANCELLED;
 			fix = answer;
 		}
-		return (await import("./doctor-DfTnMaUt.js")).runDoctor({
+		return (await import("./doctor-ktitU5Dl.js")).runDoctor({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			only: flags.only,

package/dist/{doctor-DfTnMaUt.js → doctor-ktitU5Dl.js}

@@ -24,23 +24,23 @@ import { t as parseCatalog } from "./parse-1_ZheTW5.js";
 import { n as activeTenantMismatch } from "./active-tenant-DVee32-T.js";
 import "./markers-BeHZ4x9Q.js";
 import { t as didYouMean } from "./args-0FrVs5EH.js";
-import { t as DOCS_BASE } from "./manifest-B4ENCp2I.js";
+import { t as DOCS_BASE } from "./manifest-Cav1rjNQ.js";
 import { t as createStyle } from "./style-Ds11Hmk4.js";
-import { a as nonEmptyOr, r as findingOf } from "./output-LsbLe41I.js";
-import { i as runSkillsInstall } from "./skills-iwbRxavw.js";
+import { a as nonEmptyOr, r as findingOf } from "./output-CtyBwTNB.js";
+import { i as runSkillsInstall } from "./skills-Bar7ZqwM.js";
 import { n as MIGRATION_DIRS, t as DEFAULT_SENSITIVE_ACTIONS } from "./constants-DcJABbLW.js";
 import { l as partPath } from "./output-files-BIQ_9pIs.js";
-import { _ as readSupabaseConfig, a as supabaseHookManifest, c as activeSource, d as resolveSchemas, g as pd074, h as pd045, l as pd039, m as attrsPlan, n as hookOut, v as supabaseConfig } from "./supabase-hook-BT2P9wah.js";
+import { _ as readSupabaseConfig, a as supabaseHookManifest, c as activeSource, d as resolveSchemas, g as pd074, h as pd045, l as pd039, m as attrsPlan, n as hookOut, v as supabaseConfig } from "./supabase-hook-CyuD9Wau.js";
 import { G as byKey, Q as graphSqlName, n as tableNameOf, o as graphPlan, r as tableNames } from "./tables-DimBcVWY.js";
 import { a as guardedTables, p as contextRefs, r as unsatisfiedKinds, t as ownershipRules } from "./ownership-qqBuGJXr.js";
 import { t as membershipSourcesOf } from "./sources-qoIJQrJv.js";
 import { i as group, n as membershipColumns, o as sqlStatements, r as tableKey } from "./deciding-columns-NB4wcyBf.js";
 import { t as FIELD_VIEWS } from "./fields-DI8s3cPl.js";
 import { t as resolveNames } from "./resolve-names-Y1Cb22cp.js";
-import { a as pd010, c as pd014, d as pd038, f as pd041, i as pd008, l as pd015, n as pd001, o as pd011, p as pd057, r as pd007, s as pd013, t as runUsage, u as pd036 } from "./usage-t_nXnwCW.js";
-import { d as rowConditionMessage, f as commandFor, m as tableFor, p as compileGrants, s as ROW_CONDITION_FIX, u as helperTablePolicies } from "./verify-jHrbmn-E.js";
-import { a as streamOf, i as scopeSourcesOf, r as staleFiles, t as powersyncFiles } from "./powersync-DUT-UKgw.js";
-import { a as buildContext, n as generateOptions, r as isRefusal, s as inheritTargets, t as supautilsRejections } from "./supautils-DBKOoyjn.js";
+import { a as pd010, c as pd014, d as pd038, f as pd041, i as pd008, l as pd015, n as pd001, o as pd011, p as pd057, r as pd007, s as pd013, t as runUsage, u as pd036 } from "./usage-Y6xZUfE-.js";
+import { d as rowConditionMessage, f as commandFor, m as tableFor, p as compileGrants, s as ROW_CONDITION_FIX, u as helperTablePolicies } from "./verify-6EauWrkP.js";
+import { a as streamOf, i as scopeSourcesOf, r as staleFiles, t as powersyncFiles } from "./powersync-CD8-Ypao.js";
+import { a as buildContext, n as generateOptions, r as isRefusal, s as inheritTargets, t as supautilsRejections } from "./supautils-C-_jqylY.js";
 import { n as legacyHelperNames, r as retirePlan, t as legacyHelperCalls } from "./retire-B2xffQgY.js";
 import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
 import { basename, dirname, join, resolve } from "node:path";

package/dist/{import-Iuk9mx8A.js → import-t1yqnCyG.js}

@@ -4,7 +4,7 @@ import { i as readJsonFile } from "./files-BSjrtIHw.js";
 import { t as applyFiles } from "./files-B3AA05f1.js";
 import { n as httpRequest } from "./http-DOL33cO0.js";
 import { i as schemaExpression, t as emitPermissionsModule } from "./generate-CezbCaTI.js";
-import { t as validateOpenapi } from "./schema-3PJ8wAeL.js";
+import { t as validateOpenapi } from "./schema-CQzIJdEd.js";
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";
 //#region ../../node_modules/.pnpm/yaml@2.9.1/node_modules/yaml/browser/dist/nodes/identity.js

package/dist/{init-fNF_XmTa.js → init-CY7THM2v.js}

@@ -48,7 +48,7 @@ const init = defineLeaf({
 		...forceFlag
 	},
 	async run(ctx, { flags }) {
-		const [{ runInit }, { packageManagerOf }] = await Promise.all([import("./init-DeoSvkh2.js"), import("./peer-C9LvBCcb.js")]);
+		const [{ runInit }, { packageManagerOf }] = await Promise.all([import("./init-DFwylmiN.js"), import("./peer-C9LvBCcb.js")]);
 		const agent = await packageManagerOf(ctx.cwd);
 		const selection = {
 			archetype: flags.archetype,
@@ -79,7 +79,7 @@ const presetDecode = defineLeaf({
 	positionals: presetCode,
 	flags: {},
 	async run(_ctx, { args }) {
-		const { runPreset } = await import("./init-DeoSvkh2.js");
+		const { runPreset } = await import("./init-DFwylmiN.js");
 		return runPreset("decode", args["code"] ?? "");
 	}
 });
@@ -87,7 +87,7 @@ const presetUrl = defineLeaf({
 	positionals: presetCode,
 	flags: {},
 	async run(_ctx, { args }) {
-		const { runPreset } = await import("./init-DeoSvkh2.js");
+		const { runPreset } = await import("./init-DFwylmiN.js");
 		return runPreset("url", args["code"] ?? "");
 	}
 });

package/dist/{init-DeoSvkh2.js → init-DFwylmiN.js}

@@ -1,6 +1,6 @@
 import { n as CliError } from "./errors-Vpu6rKHl.js";
 import { a as decodePreset, g as resolvePreset, i as presetFlags, n as generatePreset, o as encodePreset } from "./preset-BjLzeFpp.js";
-import { a as nonEmptyOr } from "./output-LsbLe41I.js";
+import { a as nonEmptyOr } from "./output-CtyBwTNB.js";
 import { t as addLine } from "./peer-Q0fuZ6hx.js";
 import { t as applyFiles } from "./files-B3AA05f1.js";
 import { existsSync } from "node:fs";

package/dist/{login-CutVtcmQ.js → login-B92-dZMK.js}

@@ -3,7 +3,7 @@ import { n as CliError } from "./errors-Vpu6rKHl.js";
 import { i as postForm, r as parseToken, s as runDeviceFlow } from "./device-BwbJNmb2.js";
 import { i as writeCredentials, n as deleteCredentials, r as readCredentials, t as credentialsPath } from "./storage-C2bWdvJH.js";
 import { n as randomToken, t as pkce } from "./pkce-CnmmYqUZ.js";
-import { a as nonEmptyOr } from "./output-LsbLe41I.js";
+import { a as nonEmptyOr } from "./output-CtyBwTNB.js";
 import { n as httpRequest } from "./http-DOL33cO0.js";
 import { c as READ_SCOPES, d as issuerMetadata, i as credentialsInsideRepository, l as cloudUrl, n as cliRuntime, r as credentialStorage, s as CLI_CLIENT_ID, t as CREDENTIAL_SERVICE } from "./auth--yPyZNgr.js";
 import { spawn } from "node:child_process";

package/dist/{login-DYazeWc9.js → login-C5XLYZSF.js}

@@ -27,7 +27,7 @@ const login = defineLeaf({
 		}
 	},
 	async run(ctx, { flags }) {
-		const { runLogin } = await import("./login-CutVtcmQ.js");
+		const { runLogin } = await import("./login-B92-dZMK.js");
 		return runLogin({
 			cwd: ctx.cwd,
 			url: given(flags.url),
@@ -43,7 +43,7 @@ const login = defineLeaf({
 const logout = defineLeaf({
 	flags: { ...urlFlag },
 	async run(ctx, { flags }) {
-		const { runLogout } = await import("./login-CutVtcmQ.js");
+		const { runLogout } = await import("./login-B92-dZMK.js");
 		return runLogout({
 			url: given(flags.url),
 			json: ctx.json,
@@ -55,7 +55,7 @@ const logout = defineLeaf({
 const whoami = defineLeaf({
 	flags: { ...urlFlag },
 	async run(ctx, { flags }) {
-		const { runWhoami } = await import("./login-CutVtcmQ.js");
+		const { runWhoami } = await import("./login-B92-dZMK.js");
 		return runWhoami({
 			url: given(flags.url),
 			json: ctx.json,

package/dist/{manifest-B4ENCp2I.js → manifest-Cav1rjNQ.js}

@@ -30,20 +30,20 @@ const SECTIONS = [
 				docs: "init",
 				effects: ["files"],
 				config: false,
-				load: async () => (await import("./init-fNF_XmTa.js")).init
+				load: async () => (await import("./init-CY7THM2v.js")).init
 			}),
 			group("preset", "Decode a preset code, or print its permdock.com/create link", "preset", [leaf("decode", "Print what a preset code holds", {
 				examples: ["permdock preset decode p1AQIDBAc"],
 				docs: "preset",
 				effects: [],
 				config: false,
-				load: async () => (await import("./init-fNF_XmTa.js")).presetDecode
+				load: async () => (await import("./init-CY7THM2v.js")).presetDecode
 			}), leaf("url", "Print the permdock.com/create link that opens a code", {
 				examples: ["permdock preset url p1AQIDBAc"],
 				docs: "preset",
 				effects: [],
 				config: false,
-				load: async () => (await import("./init-fNF_XmTa.js")).presetUrl
+				load: async () => (await import("./init-CY7THM2v.js")).presetUrl
 			})]),
 			group("skills", "Install, update or list the PermDock Agent Skills", "skills", [
 				leaf("install", "Copy the Agent Skills into the agent folders", {
@@ -55,21 +55,21 @@ const SECTIONS = [
 					docs: "skills",
 					effects: ["files"],
 					config: false,
-					load: async () => (await import("./skills-BUI8DMqy.js")).install
+					load: async () => (await import("./skills-BZc81VLt.js")).install
 				}),
 				leaf("update", "Replace installed skills with this version's", {
 					examples: ["permdock skills update"],
 					docs: "skills",
 					effects: ["files"],
 					config: false,
-					load: async () => (await import("./skills-BUI8DMqy.js")).update
+					load: async () => (await import("./skills-BZc81VLt.js")).update
 				}),
 				leaf("list", "List the skills and where each is installed", {
 					examples: ["permdock skills list"],
 					docs: "skills",
 					effects: [],
 					config: false,
-					load: async () => (await import("./skills-BUI8DMqy.js")).list
+					load: async () => (await import("./skills-BZc81VLt.js")).list
 				})
 			]),
 			leaf("doctor", "Check a PermDock installation and print a fix for each finding", {
@@ -82,7 +82,7 @@ const SECTIONS = [
 				effects: ["files"],
 				config: true,
 				findings: true,
-				load: async () => (await import("./doctor-B9FY9H0F.js")).doctor
+				load: async () => (await import("./doctor-DxyVeUEE.js")).doctor
 			}),
 			leaf("completion", "Print the shell completion script for bash, zsh or fish", {
 				examples: ["permdock completion zsh > ~/.zfunc/_permdock", "eval \"$(permdock completion bash)\""],
@@ -90,7 +90,7 @@ const SECTIONS = [
 				effects: [],
 				config: false,
 				shellOutput: true,
-				load: async () => (await import("./completion-VSWvaaPO.js")).completion
+				load: async () => (await import("./completion-DLTuCf53.js")).completion
 			})
 		]
 	},
@@ -132,7 +132,7 @@ const SECTIONS = [
 				effects: [],
 				config: true,
 				findings: true,
-				load: async () => (await import("./usage-B1ZJOUdr.js")).usage
+				load: async () => (await import("./usage-heV5KOiU.js")).usage
 			}),
 			leaf("diff", "Compare two policies or catalogs; exit 1 on a breaking change", {
 				examples: ["permdock diff main.catalog.json permissions.catalog.json", "permdock diff ./old-policy.ts ./src/policy.ts --impact"],
@@ -147,7 +147,7 @@ const SECTIONS = [
 				effects: [],
 				config: true,
 				findings: true,
-				load: async () => (await import("./config-kL36AxkE.js")).config
+				load: async () => (await import("./config-CmydKZr2.js")).config
 			})
 		]
 	},
@@ -164,14 +164,14 @@ const SECTIONS = [
 						"network"
 					],
 					config: true,
-					load: async () => (await import("./rls-j0YrFPpW.js")).generate
+					load: async () => (await import("./rls-BYHN5bcJ.js")).generate
 				}),
 				leaf("import", "Turn existing RLS policies into a generated definition", {
 					examples: ["permdock rls import --sql schema.sql --out src/permissions.generated.ts", "permdock rls import --db-url-stdin --out src/permissions.generated.ts"],
 					docs: "rls",
 					effects: ["files", "database:read"],
 					config: true,
-					load: async () => (await import("./rls-j0YrFPpW.js")).importPolicies
+					load: async () => (await import("./rls-BYHN5bcJ.js")).importPolicies
 				}),
 				leaf("verify", "Run the fixtures against the policies, or compare a live database", {
 					examples: [
@@ -183,21 +183,21 @@ const SECTIONS = [
 					effects: ["files", "database:read"],
 					config: true,
 					findings: true,
-					load: async () => (await import("./rls-j0YrFPpW.js")).verify
+					load: async () => (await import("./rls-BYHN5bcJ.js")).verify
 				}),
 				leaf("migrate", "Rewrite hand-written policies onto the generated helpers", {
 					examples: ["permdock rls migrate --sql supabase/migrations --dry-run", "permdock rls migrate --sql supabase/migrations"],
 					docs: "rls",
 					effects: ["rewrite", "files"],
 					config: true,
-					load: async () => (await import("./rls-j0YrFPpW.js")).migrate
+					load: async () => (await import("./rls-BYHN5bcJ.js")).migrate
 				}),
 				leaf("explain", "Show the tables, membership sources and triggers the SQL binds to", {
 					examples: ["permdock rls explain", "permdock rls explain --db-url-stdin --json"],
 					docs: "rls",
 					effects: ["database:read"],
 					config: true,
-					load: async () => (await import("./rls-j0YrFPpW.js")).explain
+					load: async () => (await import("./rls-BYHN5bcJ.js")).explain
 				})
 			]),
 			group("supabase", "Generate the Supabase Custom Access Token Hook, or inspect its manifest", "supabase", [group("hook", "The Custom Access Token Hook", "supabase", [leaf("generate", "Compile the membership sources into the hook migration", {
@@ -205,26 +205,26 @@ const SECTIONS = [
 				docs: "supabase",
 				effects: ["files", "database:read"],
 				config: true,
-				load: async () => (await import("./supabase-BaizG0n7.js")).hookGenerate
+				load: async () => (await import("./supabase-CBEK6KEo.js")).hookGenerate
 			})]), leaf("inspect", "Print or write the hook and helper manifest", {
 				examples: ["permdock supabase inspect", "permdock supabase inspect --out"],
 				docs: "supabase",
 				effects: ["files"],
 				config: true,
-				load: async () => (await import("./supabase-BaizG0n7.js")).inspect
+				load: async () => (await import("./supabase-CBEK6KEo.js")).inspect
 			})]),
 			group("powersync", "Generate PowerSync Sync Streams from the policy, or verify them", "powersync", [leaf("generate", "Compile the read grants into sync-config.yaml", {
 				examples: ["permdock powersync generate", "permdock powersync generate --check"],
 				docs: "powersync",
 				effects: ["files"],
 				config: true,
-				load: async () => (await import("./powersync-B_8uwz7f.js")).generate
+				load: async () => (await import("./powersync-CBcsEvdr.js")).generate
 			}), leaf("verify", "Fail on stale streams or a stream that syncs a denied row", {
 				examples: ["permdock powersync verify", "permdock powersync verify --db-url-stdin"],
 				docs: "powersync",
 				effects: ["database:read"],
 				config: true,
-				load: async () => (await import("./powersync-B_8uwz7f.js")).verify
+				load: async () => (await import("./powersync-CBcsEvdr.js")).verify
 			})]),
 			group("scim", "Generate the Postgres tables postgresDirectoryStore keeps a SCIM directory in", "scim", [leaf("generate", "Write the tenant-keyed users, groups and members tables", {
 				examples: [
@@ -247,13 +247,13 @@ const SECTIONS = [
 				docs: "openapi",
 				effects: ["files"],
 				config: true,
-				load: async () => (await import("./openapi-DFj0cirS.js")).emit
+				load: async () => (await import("./openapi-gMQQSzNn.js")).emit
 			}), leaf("import", "Turn an OpenAPI document into a generated definition", {
 				examples: ["permdock openapi import --doc openapi.yaml --out src/permissions.generated.ts"],
 				docs: "openapi",
 				effects: ["files", "network"],
 				config: false,
-				load: async () => (await import("./openapi-DFj0cirS.js")).importDocument
+				load: async () => (await import("./openapi-gMQQSzNn.js")).importDocument
 			})]),
 			group("arazzo", "Check Arazzo workflows against the permissions", "arazzo", [leaf("check", "Resolve every Arazzo step to x-permdock-permissions", {
 				examples: ["permdock arazzo check --doc arazzo.json --openapi openapi.json"],
@@ -261,7 +261,7 @@ const SECTIONS = [
 				effects: [],
 				config: true,
 				findings: true,
-				load: async () => (await import("./arazzo-DA9PCXew.js")).check
+				load: async () => (await import("./arazzo-BXaEhGHM.js")).check
 			})]),
 			leaf("scan", "List authorization checks written without PermDock, to adopt it in an existing app", {
 				examples: ["permdock scan", "permdock scan --src app,lib --pattern isBeta"],
@@ -269,7 +269,7 @@ const SECTIONS = [
 				effects: [],
 				config: true,
 				findings: true,
-				load: async () => (await import("./scan-B7xrAvRm.js")).scan
+				load: async () => (await import("./scan-CvFWW_fU.js")).scan
 			}),
 			group("casl", "Import CASL rules into a generated module", "casl", [leaf("import", "Turn CASL rules per role into a permissions and policy module", {
 				examples: ["permdock casl import --rules rules.json --out src/permissions.generated.ts"],
@@ -283,7 +283,7 @@ const SECTIONS = [
 				docs: "casbin",
 				effects: ["files"],
 				config: false,
-				load: async () => (await import("./casbin-BkhqGh2z.js")).casbinImport
+				load: async () => (await import("./casbin-BuTZnSPv.js")).casbinImport
 			})])
 		]
 	},
@@ -295,34 +295,34 @@ const SECTIONS = [
 				docs: "login",
 				effects: ["network", "files"],
 				config: false,
-				load: async () => (await import("./login-DYazeWc9.js")).login
+				load: async () => (await import("./login-C5XLYZSF.js")).login
 			}),
 			leaf("logout", "Revoke and delete the stored PermDock Cloud login", {
 				examples: ["permdock logout"],
 				docs: "login",
 				effects: ["network", "files"],
 				config: false,
-				load: async () => (await import("./login-DYazeWc9.js")).logout
+				load: async () => (await import("./login-C5XLYZSF.js")).logout
 			}),
 			leaf("whoami", "Print the PermDock Cloud identity the CLI acts as", {
 				examples: ["permdock whoami", "permdock whoami --json"],
 				docs: "login",
 				effects: [],
 				config: false,
-				load: async () => (await import("./login-DYazeWc9.js")).whoami
+				load: async () => (await import("./login-C5XLYZSF.js")).whoami
 			}),
 			group("cloud", "Publish to or pull from a PermDock Cloud project", "cloud", [leaf("push", "Publish the catalog, policy and manifest to a Cloud project", {
 				examples: ["permdock cloud push --dry-run", "permdock cloud push --project prj_123"],
 				docs: "cloud",
 				effects: ["network", "cloud:write"],
 				config: true,
-				load: async () => (await import("./cloud-3RIuS4E9.js")).push
+				load: async () => (await import("./cloud-DiAiYFRo.js")).push
 			}), leaf("pull", "Write a Cloud project's published catalog and manifest", {
 				examples: ["permdock cloud pull --project prj_123"],
 				docs: "cloud",
 				effects: ["network", "files"],
 				config: true,
-				load: async () => (await import("./cloud-3RIuS4E9.js")).pull
+				load: async () => (await import("./cloud-DiAiYFRo.js")).pull
 			})])
 		]
 	},
@@ -333,7 +333,7 @@ const SECTIONS = [
 			docs: "codemod",
 			effects: ["rewrite"],
 			config: false,
-			load: async () => (await import("./codemod-DLcp-B6v.js")).codemod
+			load: async () => (await import("./codemod-_q_ZI01S.js")).codemod
 		})]
 	}
 ];
@@ -345,7 +345,7 @@ const COMPLETE_LEAF = leaf("__complete", "Print completion candidates for a part
 	config: false,
 	shellOutput: true,
 	hidden: true,
-	load: async () => (await import("./completion-VSWvaaPO.js")).complete
+	load: async () => (await import("./completion-DLTuCf53.js")).complete
 });
 const ROOT = group("permdock", "Collect, export, diff and check the permissions a PermDock policy declares", "", [...SECTIONS.flatMap((section) => section.entries), COMPLETE_LEAF]);
 /** Each leaf with its path from the root, in manifest order. */

package/dist/{openapi-C-ADypaY.js → openapi-CuePQL4z.js}

@@ -7,7 +7,7 @@ import { a as loadModule, n as asPolicy, s as pickNamed, t as asPermissionTree }
 import { t as shortDiff } from "./text-diff-BtfSmdUo.js";
 import { c as openapiVersion, o as createPermDock } from "./openapi-BOsx0xn9.js";
 import { i as fileDrift } from "./output-files-BIQ_9pIs.js";
-import { n as validateOverlay, t as validateOpenapi } from "./schema-3PJ8wAeL.js";
+import { n as validateOverlay, t as validateOpenapi } from "./schema-CQzIJdEd.js";
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 //#region src/cli/openapi/openapi.ts

package/dist/{openapi-DFj0cirS.js → openapi-gMQQSzNn.js}

@@ -80,7 +80,7 @@ const emit = defineLeaf({
 		}
 	},
 	async run(ctx, { flags }) {
-		return (await import("./openapi-C-ADypaY.js")).runOpenapi({
+		return (await import("./openapi-CuePQL4z.js")).runOpenapi({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			rest: ["emit"],
@@ -122,7 +122,7 @@ const importDocument = defineLeaf({
 	async run(ctx, { flags }) {
 		const doc = given(flags.doc);
 		if (doc === void 0) throw missingInput("openapi import", ["--doc"], "the OpenAPI document to import");
-		return (await import("./import-Iuk9mx8A.js")).runOpenapiImport({
+		return (await import("./import-t1yqnCyG.js")).runOpenapiImport({
 			cwd: ctx.cwd,
 			doc,
 			out: fileOut("openapi import", flags.out),

package/dist/{output-LsbLe41I.js → output-CtyBwTNB.js}

@@ -1,5 +1,5 @@
 import { s as cliVersion } from "./version-DMQ0dnN5.js";
-import { t as DOCS_BASE } from "./manifest-B4ENCp2I.js";
+import { t as DOCS_BASE } from "./manifest-Cav1rjNQ.js";
 //#region src/cli/core/output.ts
 const CLI_RESULT_SCHEMA = "https://permdock.com/schemas/cli-result-v1.json";
 function envelope(input) {

package/dist/powersync-6vgKevSi.js

@@ -0,0 +1 @@
+export { n as runPowerSync } from "./powersync-CD8-Ypao.js";

package/dist/{powersync-B_8uwz7f.js → powersync-CBcsEvdr.js}

@@ -14,7 +14,7 @@ const generate = defineLeaf({
 	async run(ctx, { flags }) {
 		const out = fileOut("powersync", flags.out);
 		const from = given(flags.policy);
-		const { runPowerSync } = await import("./powersync-CSzDCHRu.js");
+		const { runPowerSync } = await import("./powersync-6vgKevSi.js");
 		return runPowerSync({
 			cwd: ctx.cwd,
 			config: ctx.config,
@@ -45,7 +45,7 @@ const verify = defineLeaf({
 		const db = await dbUrl(ctx, flags, { required: true });
 		const fixtures = given(flags.fixtures);
 		const from = given(flags.policy);
-		const { runPowerSync } = await import("./powersync-CSzDCHRu.js");
+		const { runPowerSync } = await import("./powersync-6vgKevSi.js");
 		return runPowerSync({
 			cwd: ctx.cwd,
 			config: ctx.config,

package/dist/{powersync-DUT-UKgw.js → powersync-CD8-Ypao.js}

@@ -19,7 +19,7 @@ import { r as tableNames } from "./tables-DimBcVWY.js";
 import { d as andConditions, l as collectGrants, o as assignableRoles, p as contextRefs, t as ownershipRules, u as roleNames } from "./ownership-qqBuGJXr.js";
 import { t as membershipSourcesOf } from "./sources-qoIJQrJv.js";
 import { n as pgConnector } from "./pg-DQTqRrou.js";
-import { m as tableFor, t as canFixture } from "./verify-jHrbmn-E.js";
+import { m as tableFor, t as canFixture } from "./verify-6EauWrkP.js";
 import { resolve } from "node:path";
 //#region src/cli/powersync/names.ts
 function ident(name) {

package/dist/{pull-DQCgvJSC.js → pull-CAeaAioC.js}

@@ -7,7 +7,7 @@ import { o as formatCatalogJson } from "./catalog-doc-DjMKzJp9.js";
 import { t as catalogPath } from "./catalog-path-CnI0XTFK.js";
 import { n as parseSupabaseManifest } from "./manifest-BXTbHNIV.js";
 import { t as parseCatalog } from "./parse-1_ZheTW5.js";
-import { a as nonEmptyOr } from "./output-LsbLe41I.js";
+import { a as nonEmptyOr } from "./output-CtyBwTNB.js";
 import { t as POLICY_NOT_PUBLISHED } from "./problem-types-DSsRfONQ.js";
 import { n as httpRequest, t as authFailure } from "./http-DOL33cO0.js";
 import { l as cloudUrl, n as cliRuntime, o as readAuth } from "./auth--yPyZNgr.js";

package/dist/pull-DfJALUbS.js

@@ -0,0 +1 @@
+export { n as runCloudPull } from "./pull-CAeaAioC.js";

package/dist/{rls-j0YrFPpW.js → rls-BYHN5bcJ.js}

@@ -192,7 +192,7 @@ async function rlsInput(ctx, verb, shape, options) {
 	};
 }
 async function runRls(input) {
-	return (await import("./rls-B57mIeVq.js")).runRls(input);
+	return (await import("./rls-CtRaRrn3.js")).runRls(input);
 }
 const generate = defineLeaf({
 	flags: {

package/dist/{rls-B57mIeVq.js → rls-CtRaRrn3.js}

@@ -11,13 +11,13 @@ import "./sources-C4vkzZJV.js";
 import { t as policyFromCatalog } from "./policy-from-catalog-CU3An8uP.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
 import { i as INDEXES_MARKER, n as GRANTS_MARKER, o as SEEDS_MARKER, t as BACKFILL_MARKER } from "./markers-BeHZ4x9Q.js";
-import { a as nonEmptyOr } from "./output-LsbLe41I.js";
+import { a as nonEmptyOr } from "./output-CtyBwTNB.js";
 import { i as requirePeer, n as packageManagerOf, t as addLine } from "./peer-Q0fuZ6hx.js";
 import { t as POLICY_NOT_PUBLISHED } from "./problem-types-DSsRfONQ.js";
-import { t as fetchProjectPolicy } from "./pull-DQCgvJSC.js";
+import { t as fetchProjectPolicy } from "./pull-CAeaAioC.js";
 import { n as MIGRATION_DIRS } from "./constants-DcJABbLW.js";
 import { a as isSeedsDirectory, c as parseSplit, d as seedsMigration, f as writeOutputFiles, l as partPath, n as dataMigrationFile, r as driftOf, u as pgDeltaPath } from "./output-files-BIQ_9pIs.js";
-import { b as rbacScaffold, d as resolveSchemas, f as schemasRefusal, o as supabaseHookSql, p as declarativeSql, s as approvalsSql, t as grantsLabel, u as isSupabaseSchemas, y as parseRbacAuthorize } from "./supabase-hook-BT2P9wah.js";
+import { b as rbacScaffold, d as resolveSchemas, f as schemasRefusal, o as supabaseHookSql, p as declarativeSql, s as approvalsSql, t as grantsLabel, u as isSupabaseSchemas, y as parseRbacAuthorize } from "./supabase-hook-CyuD9Wau.js";
 import { A as quoteQualified, D as qualified$1, I as scopeTypeOf, O as quoteIdent$1, _ as subjectClaimJsonSql, c as SESSION_LIVE_HELPER, g as sessionLiveHelperSql, j as quoteTable, k as quoteLiteral, r as HELPERS, t as CUSTOM_ROLES, y as subjectIdSql } from "./shared-DrGLwM3s.js";
 import { C as accessSql, G as byKey, T as seedSql, Z as graphHelper, ct as memberIdsHelper, ft as permittedIdsHelper, ht as scopeTable, mt as scopeSources, r as tableNames, s as graphSql, w as helpersSql, x as permittedByPermissionHelper, y as permissionHelpersSql } from "./tables-DimBcVWY.js";
 import { c as breakGlassKey, i as assignmentSql, l as collectGrants, n as ownershipSql, s as breakGlassHolder } from "./ownership-qqBuGJXr.js";
@@ -25,8 +25,8 @@ import { a as splitUndiffed } from "./deciding-columns-NB4wcyBf.js";
 import { t as connectPgPool } from "./pg-DQTqRrou.js";
 import { a as fieldViewsSql, c as ACTOR_MAY_WRITE, f as readOnlyActorKinds, i as fieldViews, l as actorMayWriteSql, n as columnGrantSql, o as rowBranches, p as readOnlyActorPolicies, r as columnRevokeSql, u as assemblePolicies } from "./fields-DI8s3cPl.js";
 import { n as permissionHoldersSql } from "./resolve-names-Y1Cb22cp.js";
-import { _ as indexTargets, a as verifyResult, b as readTableIndexFacts, c as callsHelper, g as INDEX_COLUMNS_SQL, h as COLUMNS_SQL, i as verifyIgnores, l as helperCallKeys, m as tableFor, n as runRlsVerify, o as HELPER_TABLES, p as compileGrants, r as rlsFinding, v as indexesSql, y as pruneIndexTargets } from "./verify-jHrbmn-E.js";
-import { a as buildContext, c as levelKeys, d as rebuildPlan, i as splitsPart, l as rowHelpersSql, n as generateOptions, o as CANDIDATES, r as isRefusal, s as inheritTargets, t as supautilsRejections, u as DROPPED_LIST } from "./supautils-DBKOoyjn.js";
+import { _ as indexTargets, a as verifyResult, b as readTableIndexFacts, c as callsHelper, g as INDEX_COLUMNS_SQL, h as COLUMNS_SQL, i as verifyIgnores, l as helperCallKeys, m as tableFor, n as runRlsVerify, o as HELPER_TABLES, p as compileGrants, r as rlsFinding, v as indexesSql, y as pruneIndexTargets } from "./verify-6EauWrkP.js";
+import { a as buildContext, c as levelKeys, d as rebuildPlan, i as splitsPart, l as rowHelpersSql, n as generateOptions, o as CANDIDATES, r as isRefusal, s as inheritTargets, t as supautilsRejections, u as DROPPED_LIST } from "./supautils-C-_jqylY.js";
 import { readFileSync } from "node:fs";
 import { basename, delimiter, join } from "node:path";
 import { spawn } from "node:child_process";

package/dist/run-0vOholnN.js

@@ -0,0 +1 @@
+export { t as run } from "./run-B5nyNKe8.js";

package/dist/{run-CLP_fQUF.js → run-B5nyNKe8.js}

@@ -5,9 +5,9 @@ import { a as resolveCwd, i as readConfig } from "./config-BR23fL8m.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
 import { a as suggestion, i as parseLeaf, n as flagSpellings, o as GLOBAL_FLAGS, r as parseFlags } from "./args-0FrVs5EH.js";
 import { r as progressReporter, t as redact } from "./credentials-CdDxp7jN.js";
-import { a as resolve, i as leaves, n as ROOT, r as SECTIONS, t as DOCS_BASE } from "./manifest-B4ENCp2I.js";
+import { a as resolve, i as leaves, n as ROOT, r as SECTIONS, t as DOCS_BASE } from "./manifest-Cav1rjNQ.js";
 import { t as createStyle } from "./style-Ds11Hmk4.js";
-import { i as githubAnnotations, n as envelope, o as sarifLog, t as dataOf } from "./output-LsbLe41I.js";
+import { i as githubAnnotations, n as envelope, o as sarifLog, t as dataOf } from "./output-CtyBwTNB.js";
 import { i as renameMessage, r as flagRename, t as COMMAND_MOVES } from "./renames-CGj7YwcQ.js";
 import { stripVTControlCharacters } from "node:util";
 import { existsSync, statSync } from "node:fs";

package/dist/{scan-B7xrAvRm.js → scan-CvFWW_fU.js}

@@ -16,7 +16,7 @@ const scan = defineLeaf({
 		}
 	},
 	async run(ctx, { flags }) {
-		const { runAdoptionScan } = await import("./adoption-scan-0oFt2RD5.js");
+		const { runAdoptionScan } = await import("./adoption-scan-DKCOsfcF.js");
 		return runAdoptionScan({
 			cwd: ctx.cwd,
 			srcPath: flags.src.length > 0 ? flags.src : ctx.config.collect?.srcPath ?? ["src"],

package/dist/{schema-3PJ8wAeL.js → schema-CQzIJdEd.js}

@@ -1,7 +1,7 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
 import { l as packageRoot } from "./version-DMQ0dnN5.js";
 import { t as DRAFT_PINS } from "./pins-nqarl3oE.js";
-import { a as nonEmptyOr } from "./output-LsbLe41I.js";
+import { a as nonEmptyOr } from "./output-CtyBwTNB.js";
 import { t as require__2020 } from "./2020-CJbO8Bvz.js";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";

package/dist/{skills-BUI8DMqy.js → skills-BZc81VLt.js}

@@ -1,7 +1,7 @@
 import { t as defineLeaf } from "./command-L8EstFNm.js";
 import { t as checkFlag } from "./flags-DXjoTVbS.js";
 import { r as pick, t as CANCELLED } from "./prompt-BYc6drYW.js";
-import { n as detectedAgents, r as runSkills, t as SKILL_AGENTS } from "./skills-iwbRxavw.js";
+import { n as detectedAgents, r as runSkills, t as SKILL_AGENTS } from "./skills-Bar7ZqwM.js";
 //#region src/cli/commands/skills.ts
 const forFlag = { for: {
 	type: "string",

package/dist/{skills-iwbRxavw.js → skills-Bar7ZqwM.js}

@@ -2,7 +2,7 @@ import { t as byCodePoint } from "./compare-DTfyUunF.js";
 import { i as readJsonFile } from "./files-BSjrtIHw.js";
 import { l as packageRoot } from "./version-DMQ0dnN5.js";
 import { t as didYouMean } from "./args-0FrVs5EH.js";
-import { a as nonEmptyOr } from "./output-LsbLe41I.js";
+import { a as nonEmptyOr } from "./output-CtyBwTNB.js";
 import { cpSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, realpathSync, writeFileSync } from "node:fs";
 import { basename, dirname, join, relative, resolve } from "node:path";
 import { pathToFileURL } from "node:url";

package/dist/supabase/index.d.ts

@@ -40,6 +40,14 @@ type SupabaseApprovalStoreOptions = {
   readonly schema?: string;
   /** Seconds a request stays open when the caller sets no `ttl`. */
   readonly ttl?: number;
+  /**
+   * Runs on every `create`, before the call that stores the request, with the
+   * request: insert the app's own row holding `request.token`, which `open:
+   * 'attach'` then attaches the request to. A repeated ask and a retried open
+   * run it again, so it must be idempotent, such as an insert that ignores a
+   * conflict on the token. A throw fails the open before anything is stored.
+   */
+  readonly beforeOpen?: (request: ApprovalRequest) => void | Promise<void>;
   /**
    * Runs once per stored request, after the call that stored it, with the
    * stored request: notify the approvers, or cancel the requests this one

package/dist/supabase/index.js

@@ -1,4 +1,4 @@
-import { a as supabaseClaims, i as supabaseApprovalStore, n as supabaseRls, o as exchangeCapability, r as tableApprovalDelegationSource, t as authorizeSql } from "../supabase-B1EfuD47.js";
+import { a as supabaseClaims, i as supabaseApprovalStore, n as supabaseRls, o as exchangeCapability, r as tableApprovalDelegationSource, t as authorizeSql } from "../supabase-CC6rIri4.js";
 import { n as supabaseTenantClaim, t as supabaseMembershipsBudget } from "../budget-BELja5A9.js";
 import { c as tableMembershipSource, i as authzVersion, o as junctionMembershipSource, s as supabasePostgresQuery, t as AUTHZ_VERSION_TABLE } from "../sources-C4vkzZJV.js";
 import { a as delegationOf, c as subjectFromSupabaseSession, i as actorOf, n as postgrestSources, r as readSubjectRecord, s as subjectFromSupabase } from "../postgrest-DAxFltvO.js";

package/dist/{supabase-BaizG0n7.js → supabase-CBEK6KEo.js}

@@ -47,7 +47,7 @@ const hookGenerate = defineLeaf({
 		const budget = given(flags.budget);
 		const schema = given(flags.schema);
 		const grantsOut = given(flags["grants-out"]);
-		const { runSupabase } = await import("./supabase-hook-CbvGAutK.js");
+		const { runSupabase } = await import("./supabase-hook-CWvEpdCh.js");
 		return runSupabase({
 			cwd: ctx.cwd,
 			config: ctx.config,
@@ -76,7 +76,7 @@ const inspect = defineLeaf({
 	},
 	async run(ctx, { flags }) {
 		const out = flags.out === "" ? true : flags.out === "-" ? void 0 : flags.out;
-		const { runSupabase } = await import("./supabase-hook-CbvGAutK.js");
+		const { runSupabase } = await import("./supabase-hook-CWvEpdCh.js");
 		return runSupabase({
 			cwd: ctx.cwd,
 			config: ctx.config,

package/dist/{supabase-B1EfuD47.js → supabase-CC6rIri4.js}

@@ -278,6 +278,7 @@ function supabaseApprovalStore(client, options = {}) {
 	return {
 		...options.ttl === void 0 ? {} : { ttl: options.ttl },
 		async create(request) {
+			await options.beforeOpen?.(request);
 			await call("permdock_approval_open", { p_request: request });
 			if (options.onOpen !== void 0) {
 				const stored = await get(request.token);

package/dist/supabase-hook-CWvEpdCh.js

@@ -0,0 +1 @@
+export { i as runSupabase } from "./supabase-hook-CyuD9Wau.js";

package/dist/{supabase-hook-BT2P9wah.js → supabase-hook-CyuD9Wau.js}

@@ -8,7 +8,7 @@ import { a as SUPABASE_MANIFEST_SCHEMA } from "./version-DMQ0dnN5.js";
 import { c as requirePolicy } from "./load-DjSU5KXO.js";
 import { i as qualifySqlTable } from "./sql-0WjxIp9g.js";
 import { i as scopeColumn } from "./compile-EzEMB-7v.js";
-import { t as authorizeSql } from "./supabase-B1EfuD47.js";
+import { t as authorizeSql } from "./supabase-CC6rIri4.js";
 import "./budget-BELja5A9.js";
 import { a as hookApiNames, d as keptKeys, t as AUTHZ_VERSION_TABLE, u as roleManifest } from "./sources-C4vkzZJV.js";
 import { o as readMemberships } from "./postgrest-DAxFltvO.js";

package/dist/{supautils-DBKOoyjn.js → supautils-C-_jqylY.js}

@@ -8,7 +8,7 @@ import "./budget-BELja5A9.js";
 import { l as roleColumn } from "./sources-C4vkzZJV.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
 import { c as parseSplit } from "./output-files-BIQ_9pIs.js";
-import { x as resolveAuthorize } from "./supabase-hook-BT2P9wah.js";
+import { x as resolveAuthorize } from "./supabase-hook-CyuD9Wau.js";
 import { A as quoteQualified, C as parseMembershipsFlag, D as qualified, F as firstScopeType, O as quoteIdent, R as tenantTypeOf, a as customRolesOn, j as quoteTable, k as quoteLiteral, s as signedIn, t as CUSTOM_ROLES } from "./shared-DrGLwM3s.js";
 import { G as byKey, H as rolesTableScope, O as tokenScopesPlan, Q as graphSqlName, V as raiseSql, W as byCodeUnit, Y as apiKeysPlan, a as closureDepths, bt as checkSuspension, i as tablelessResources, o as graphPlan, r as tableNames, t as resolveVias, z as currentKeyExpr } from "./tables-DimBcVWY.js";
 import { o as assignableRoles, r as unsatisfiedKinds, t as ownershipRules, u as roleNames } from "./ownership-qqBuGJXr.js";
@@ -16,7 +16,7 @@ import { t as membershipSourcesOf } from "./sources-qoIJQrJv.js";
 import { i as group, o as sqlStatements } from "./deciding-columns-NB4wcyBf.js";
 import { d as orSql, h as branchClauses } from "./fields-DI8s3cPl.js";
 import { t as resolveNames } from "./resolve-names-Y1Cb22cp.js";
-import { m as tableFor } from "./verify-jHrbmn-E.js";
+import { m as tableFor } from "./verify-6EauWrkP.js";
 //#region src/cli/rls/custom-role-rebuild.ts
 const PREFIX = "PermDock CLI";
 /** A column of the roles-table row `r`. */

package/dist/usage-CNca1i1W.js

@@ -0,0 +1 @@
+export { t as runUsage } from "./usage-Y6xZUfE-.js";

package/dist/{usage-t_nXnwCW.js → usage-Y6xZUfE-.js}

@@ -6,8 +6,8 @@ import { c as jsonSchemaOf } from "./catalog-doc-DjMKzJp9.js";
 import { a as loadModule, n as asPolicy, s as pickNamed } from "./load-DjSU5KXO.js";
 import { r as runCollect } from "./collect-WCl8cJQV.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
-import { t as DOCS_BASE } from "./manifest-B4ENCp2I.js";
-import { r as findingOf } from "./output-LsbLe41I.js";
+import { t as DOCS_BASE } from "./manifest-Cav1rjNQ.js";
+import { r as findingOf } from "./output-CtyBwTNB.js";
 import { existsSync, readFileSync, realpathSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";

package/dist/{usage-B1ZJOUdr.js → usage-heV5KOiU.js}

@@ -16,7 +16,7 @@ const usage = defineLeaf({
 		}
 	},
 	async run(ctx, { flags }) {
-		return (await import("./usage-weohzv2f.js")).runUsage({
+		return (await import("./usage-CNca1i1W.js")).runUsage({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			ignore: flags.ignore,

package/dist/{verify-jHrbmn-E.js → verify-6EauWrkP.js}

@@ -22,7 +22,7 @@ import { a as scopeMembershipTable, i as scopeColumn } from "./compile-EzEMB-7v.
 import "./budget-BELja5A9.js";
 import "./sources-C4vkzZJV.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
-import { t as DOCS_BASE } from "./manifest-B4ENCp2I.js";
+import { t as DOCS_BASE } from "./manifest-Cav1rjNQ.js";
 import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-A1_sp_tR.js";
 import { A as quoteQualified, N as arrayColumnsOf, O as quoteIdent, P as columnTypesOf, _ as subjectClaimJsonSql, a as customRolesOn, j as quoteTable, k as quoteLiteral, r as HELPERS, v as subjectClaimSql } from "./shared-DrGLwM3s.js";
 import { C as accessSql, D as tokenScopeAllowsCall, S as requiresSql, ht as scopeTable, k as capabilityAccessSql, n as tableNameOf, o as graphPlan, q as apiKeyAllowsCall, r as tableNames } from "./tables-DimBcVWY.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "permdock",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "description": "Typed permissions for TypeScript apps, APIs, databases, and AI agents, with the permdock CLI and test runners.",
   "keywords": [
     "ai-agents",

package/skills/permdock-approvals/references/stores-and-resume.md

@@ -28,7 +28,7 @@ app.all("/permdock/approvals/*", (c) => handler(c.req.raw));
 
 The store's `ttl` is the window a request stays open when the call sets none; `resumeDecision({ ..., ttl })` sets it per call (milliseconds). A grant's `approval.ttl` only shortens either.
 
-- `memoryApprovalStore` is per process. On serverless or with several replicas, implement `ApprovalStore` over the app's database; the Drizzle recipe on the adapter page is the template, and `cloud().approvals` from `permdock/cloud` is the hosted implementation of the same interface. On Postgres or Supabase, set `rls.approvals: true` and use `supabaseApprovalStore(admin, { onOpen })` from `permdock/supabase` over the generated table and functions; grant the functions to the server's role, and put notifications and superseding older requests in `onOpen`.
+- `memoryApprovalStore` is per process. On serverless or with several replicas, implement `ApprovalStore` over the app's database; the Drizzle recipe on the adapter page is the template, and `cloud().approvals` from `permdock/cloud` is the hosted implementation of the same interface. On Postgres or Supabase, set `rls.approvals: true` and use `supabaseApprovalStore(admin, { onOpen })` from `permdock/supabase` over the generated table and functions; grant the functions to the server's role, and put notifications and superseding older requests in `onOpen`. Over an adopted table with `open: 'attach'`, insert the app's own row holding `request.token` in `beforeOpen`, which runs before every open and must ignore a conflict on the token.
 - A custom store calls `assertApprover(request, by, requireDistinct, now, verdict.relations)` in `resolve` and computes the next record with `applyApprovalVerdict`, which records each signature's `stage`. `verdict.relations` holds `approverRelationKey` values that the handler, or `resolveApproval(store, token, verdict, { relations, permissions })`, computed with `approverRelations`; a store never derives them. `consume` must be atomic: two concurrent calls never both succeed.
 - When the app's own rules decide who approves (a manager chain, delegates, a quorum it counts), record their verdict with `vouchApproval(store, token, { status, by, rule })` from `permdock/approvals` instead of mirroring those rules in `approvers` or copying the verdict into the request by hand. It resolves the request at once and records `vouched: rule`; the actor, requester and repeat checks still apply. Never take `vouched` from a request body.
 - Run `testApprovalStore(store, { reopen, capabilities: { expire } })` from `permdock/testing` on every custom store. `reopen` opens a second client over the same backend; `expire(token)` ages one record so the suite checks that a new ask replaces it.

package/dist/powersync-CSzDCHRu.js

@@ -1 +0,0 @@
-export { n as runPowerSync } from "./powersync-DUT-UKgw.js";

package/dist/pull-DYbyod1f.js

@@ -1 +0,0 @@
-export { n as runCloudPull } from "./pull-DQCgvJSC.js";

package/dist/run-BATawNVH.js

@@ -1 +0,0 @@
-export { t as run } from "./run-CLP_fQUF.js";

package/dist/supabase-hook-CbvGAutK.js

@@ -1 +0,0 @@
-export { i as runSupabase } from "./supabase-hook-BT2P9wah.js";

package/dist/usage-weohzv2f.js

@@ -1 +0,0 @@
-export { t as runUsage } from "./usage-t_nXnwCW.js";