permdock 0.14.0 → 0.16.0

package/dist/{adoption-scan-BGtwGfoH.js → adoption-scan-C2BCiUEG.js}

@@ -1,5 +1,5 @@
 import { r as listSourceFiles } from "./files-BSjrtIHw.js";
-import { t as DOCS_BASE } from "./manifest-BWIR_EEB.js";
+import { t as DOCS_BASE } from "./manifest-Cft51TLK.js";
 import { readFileSync } from "node:fs";
 import { relative } from "node:path";
 //#region src/cli/adoption-scan.ts

package/dist/{arazzo-Bol9OgF-.js → arazzo-CHoYnQXO.js}

@@ -21,7 +21,7 @@ const check = defineLeaf({
 		...permissionsFlag
 	},
 	async run(ctx, { flags }) {
-		return (await import("./arazzo-9uhbmKf5.js")).runArazzo({
+		return (await import("./arazzo-ClYz2Z0W.js")).runArazzo({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			doc: given(flags.doc),

package/dist/{arazzo-9uhbmKf5.js → arazzo-ClYz2Z0W.js}

@@ -3,7 +3,7 @@ import { c as missingInput } from "./errors-Vpu6rKHl.js";
 import { i as readJsonFile } from "./files-BSjrtIHw.js";
 import { t as ARAZZO_REPORT_SCHEMA } from "./version-DMQ0dnN5.js";
 import { a as loadModule, s as pickNamed, t as asPermissionTree } from "./load-DjSU5KXO.js";
-import { t as DOCS_BASE } from "./manifest-BWIR_EEB.js";
+import { t as DOCS_BASE } from "./manifest-Cft51TLK.js";
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 //#region src/cli/arazzo.ts

package/dist/better-supabase/index.d.ts

@@ -480,8 +480,12 @@ type AuthorizerOptions = {
    */
   readonly memberships?: MembershipSource | readonly MembershipSource[];
   /**
-   * The current authorization version for `memberships`, such as
-   * `authzVersion({ query })`; default the source's own `version`.
+   * Reads the user's current authorization version, which `claimsFirst`
+   * compares with the token's `authz_ver` claim; default the source's own
+   * `version`. Pass `authzVersion({ query })` from `permdock/supabase`, which
+   * reads `permdock_authz_version`, the table the token hook stamps `authz_ver`
+   * from, when the membership source has no `version` of its own or reads
+   * another one.
    */
   readonly version?: MembershipSource["version"];
   /**

package/dist/{better-supabase-83Gsetrv.js → better-supabase-Dirf_8Ec.js}

@@ -37,20 +37,36 @@ async function betterSupabaseConfig(input) {
 		return;
 	}
 }
+function stringAt(value, ...path) {
+	let at = value;
+	for (const key of path) {
+		if (!isRecord(at)) return void 0;
+		at = at[key];
+	}
+	return typeof at === "string" && at !== "" ? at : void 0;
+}
+/**
+* The claim better-supabase writes the active tenant to:
+* `auth.organization.claim` in a grouped config, `claims.tenant` in a flat one,
+* then `rls.tenantClaim` and `tenant_id`.
+*/
+function betterSupabaseTenantClaim(config, betterSupabase) {
+	return stringAt(betterSupabase, "auth", "organization", "claim") ?? stringAt(betterSupabase, "claims", "tenant") ?? config.rls?.tenantClaim ?? "tenant_id";
+}
 /** Resolve the hook default once for generation, inspection and doctor. */
-function betterSupabaseDefaults(config, detected) {
+function betterSupabaseDefaults(config, betterSupabase) {
 	const hook = config.supabase?.hook;
-	if (!detected || hook === void 0 || hook.activeFrom !== void 0) return config;
+	if (betterSupabase === void 0 || hook === void 0 || hook.activeFrom !== void 0) return config;
 	return {
 		...config,
 		supabase: {
 			...config.supabase,
 			hook: {
 				...hook,
-				activeFrom: `app_metadata.${config.rls?.tenantClaim ?? "tenant_id"}`
+				activeFrom: `app_metadata.${betterSupabaseTenantClaim(config, betterSupabase)}`
 			}
 		}
 	};
 }
 //#endregion
-export { readJson as a, nodeFiles as i, betterSupabaseDefaults as n, filesOf as r, betterSupabaseConfig as t };
+export { nodeFiles as a, filesOf as i, betterSupabaseDefaults as n, readJson as o, betterSupabaseTenantClaim as r, betterSupabaseConfig as t };

package/dist/{casbin-CBXD5rFx.js → casbin-C9EvElBb.js}

@@ -1,4 +1,4 @@
-import { a as nonEmptyOr } from "./output-3iB3_Hfg.js";
+import { a as nonEmptyOr } from "./output-DlICTjBh.js";
 import { t as applyFiles } from "./files-B3AA05f1.js";
 import { n as isIdentifier, t as emitPolicyModule } from "./policy-module-xym9fnSq.js";
 import { existsSync, readFileSync } from "node:fs";

package/dist/{casbin-1PVgMHOR.js → casbin-D_rVQ31U.js}

@@ -16,7 +16,7 @@ const casbinImport = defineLeaf({
 		...outFlag
 	},
 	async run(ctx, { flags }) {
-		const { runCasbinImport } = await import("./casbin-CBXD5rFx.js");
+		const { runCasbinImport } = await import("./casbin-C9EvElBb.js");
 		return runCasbinImport({
 			cwd: ctx.cwd,
 			model: given(flags.model),

package/dist/cli/bin.js

@@ -11,7 +11,7 @@ if (argv.length === 1 && (argv[0] === "--version" || argv[0] === "-v")) {
 	const [{ isCi }, { trapSignals }, { run }, { streamHasColors }] = await Promise.all([
 		import("../env-DJZrPjRi.js"),
 		import("../signals-B1vHR3fN.js"),
-		import("../run-DGSLvGty.js"),
+		import("../run-C5P3x1EI.js"),
 		import("../style-DblOtSga.js")
 	]);
 	const signals = trapSignals();

package/dist/cli/index.js

@@ -1,8 +1,8 @@
 import { t as catalogPath } from "../catalog-path-CnI0XTFK.js";
-import { t as defineConfig } from "../config-ZZdtyQZy.js";
+import { t as defineConfig } from "../config-CcLlvEYW.js";
 import { n as parsePushedPolicy, r as pushedPolicy, t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-CDuOL2de.js";
 import { c as parseGrantsMarker, l as parseHookMarker } from "../markers-BeHZ4x9Q.js";
-import { t as run } from "../run-BlxXmaDS.js";
+import { t as run } from "../run-DUq1xU4K.js";
 //#region src/cli/token-schemas.ts
 const ID = {
 	type: "string",

package/dist/{cloud-BfJVKpcN.js → cloud-DdaJ7ILM.js}

@@ -70,7 +70,7 @@ const pull = defineLeaf({
 	},
 	async run(ctx, { flags }) {
 		const env = await withStdinSecret(ctx, "token", flags["token-stdin"], "PERMDOCK_CLOUD_TOKEN");
-		return (await import("./pull-BY1METGf.js")).runCloudPull({
+		return (await import("./pull-CCAChKuy.js")).runCloudPull({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			url: given(flags.url),

package/dist/{codemod-DWfH-KHk.js → codemod-B1USJS7a.js}

@@ -7,7 +7,7 @@ const codemod = defineLeaf({
 		description: "The release to migrate to (0.5)",
 		required: true,
 		async complete() {
-			return (await import("./codemod-BXLd4K3j.js")).codemodVersions();
+			return (await import("./codemod-ammy6wv4.js")).codemodVersions();
 		}
 	}, {
 		name: "paths",
@@ -22,7 +22,7 @@ const codemod = defineLeaf({
 		}
 	},
 	async run(ctx, { flags, args, rest }) {
-		return (await import("./codemod-BXLd4K3j.js")).runCodemod({
+		return (await import("./codemod-ammy6wv4.js")).runCodemod({
 			cwd: ctx.cwd,
 			version: args["version"],
 			paths: rest,

package/dist/{codemod-BXLd4K3j.js → codemod-ammy6wv4.js}

@@ -1,7 +1,7 @@
 import { n as CliError } from "./errors-Vpu6rKHl.js";
 import { a as rel } from "./files-BSjrtIHw.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
-import { n as ROOT } from "./manifest-BWIR_EEB.js";
+import { n as ROOT } from "./manifest-Cft51TLK.js";
 import { i as renameMessage, n as DEFAULT_CHANGES, r as flagRename, t as COMMAND_MOVES } from "./renames-CGj7YwcQ.js";
 import { i as refuseDirty, t as applyFiles } from "./files-B3AA05f1.js";
 import { readFileSync, readdirSync, statSync } from "node:fs";

package/dist/{collect-lZgCKMe_.js → collect-DnXL4B8c.js}

@@ -29,7 +29,7 @@ const collect = defineLeaf({
 		};
 		if (flags.watch) {
 			if (flags.check) throw new CliError("usage", "collect: --watch writes the catalog; drop --check", { code: "invalid_value" });
-			return (await import("./watch-C44FtM79.js")).watchCollect(ctx, overrides);
+			return (await import("./watch-CuPz0D2M.js")).watchCollect(ctx, overrides);
 		}
 		const result = await (await import("./collect-D-eroIfV.js")).runCollect({
 			cwd: ctx.cwd,

package/dist/{completion-fJ19i8Jk.js → completion--Y4YItFZ.js}

@@ -1,6 +1,6 @@
 import { n as CliError } from "./errors-Vpu6rKHl.js";
 import { a as suggestion, o as GLOBAL_FLAGS } from "./args-0FrVs5EH.js";
-import { a as resolve } from "./manifest-BWIR_EEB.js";
+import { a as resolve } from "./manifest-Cft51TLK.js";
 import { t as defineLeaf } from "./command-L8EstFNm.js";
 //#region src/cli/core/completion.ts
 const SHELLS = [

package/dist/{config-BYSk3iKV.js → config-BQ77xMZk.js}

@@ -10,7 +10,7 @@ const config = defineLeaf({
 		...failOnFlag
 	},
 	async run(ctx, { flags }) {
-		const { runConfig } = await import("./config-report-BpztJ3HP.js");
+		const { runConfig } = await import("./config-report-DVMOLJ7F.js");
 		return runConfig({
 			cwd: ctx.cwd,
 			config: ctx.config,

package/dist/{config-ZZdtyQZy.js → config-CcLlvEYW.js}

@@ -1,6 +1,6 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
 import { i as configError, n as CliError } from "./errors-Vpu6rKHl.js";
-import { n as betterSupabaseDefaults, t as betterSupabaseConfig } from "./better-supabase-83Gsetrv.js";
+import { n as betterSupabaseDefaults, t as betterSupabaseConfig } from "./better-supabase-Dirf_8Ec.js";
 import { a as isSection, i as isModuleKey, n as MODULE_KEYS, o as kindOf, r as describeKinds, t as CONFIG_SHAPE } from "./config-shape-tsxHx71E.js";
 import { existsSync } from "node:fs";
 import { relative, resolve } from "node:path";
@@ -84,7 +84,7 @@ async function readConfig(cwd, fromFlag, options) {
 	const parsed = parseConfig(hasModuleValue(raw) ? await traceValues(cwd, path, display, raw, options) : raw, display);
 	return {
 		...parsed,
-		config: betterSupabaseDefaults(parsed.config, await betterSupabaseConfig({ cwd }) !== void 0),
+		config: betterSupabaseDefaults(parsed.config, await betterSupabaseConfig({ cwd })),
 		file: path
 	};
 }

package/dist/{config-report-BpztJ3HP.js → config-report-DVMOLJ7F.js}

@@ -3,7 +3,7 @@ import { r as CONFIG_REPORT_SCHEMA } from "./version-DMQ0dnN5.js";
 import { t as catalogPath } from "./catalog-path-CnI0XTFK.js";
 import { n as guessPermissions, t as barrelFile } from "./collect-WCl8cJQV.js";
 import "./sources-C4vkzZJV.js";
-import { t as DOCS_BASE } from "./manifest-BWIR_EEB.js";
+import { t as DOCS_BASE } from "./manifest-Cft51TLK.js";
 import { n as MIGRATION_DIRS, t as DEFAULT_SENSITIVE_ACTIONS } from "./constants-DcJABbLW.js";
 //#region src/cli/config-report.ts
 function configReport(input) {

package/dist/{doctor-NxCr_hba.js → doctor-CwYc2lJb.js}

@@ -10,7 +10,7 @@ const doctor = defineLeaf({
 			description: "Check codes or groups to run",
 			valueHint: "code",
 			async complete() {
-				const { DOCTOR_CHECKS } = await import("./doctor-eNc7A_7I.js");
+				const { DOCTOR_CHECKS } = await import("./doctor-D1Xnmy6u.js");
 				return [.../* @__PURE__ */ new Set([...DOCTOR_CHECKS.map(({ code }) => code), ...DOCTOR_CHECKS.flatMap(({ groups }) => groups)])];
 			}
 		},
@@ -27,7 +27,7 @@ const doctor = defineLeaf({
 			if (answer === void 0) return CANCELLED;
 			fix = answer;
 		}
-		return (await import("./doctor-eNc7A_7I.js")).runDoctor({
+		return (await import("./doctor-D1Xnmy6u.js")).runDoctor({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			only: flags.only,

package/dist/{doctor-eNc7A_7I.js → doctor-D1Xnmy6u.js}

@@ -17,7 +17,7 @@ import { a as loadModule, i as loadConfiguredPolicy, n as asPolicy, s as pickNam
 import { t as catalogPath } from "./catalog-path-CnI0XTFK.js";
 import { r as runCollect } from "./collect-WCl8cJQV.js";
 import { n as supabaseTenantClaim } from "./budget-BELja5A9.js";
-import { a as readJson, i as nodeFiles, n as betterSupabaseDefaults, r as filesOf, t as betterSupabaseConfig } from "./better-supabase-83Gsetrv.js";
+import { a as nodeFiles, i as filesOf, n as betterSupabaseDefaults, o as readJson, r as betterSupabaseTenantClaim, t as betterSupabaseConfig } from "./better-supabase-Dirf_8Ec.js";
 import { i as qualifySqlTable, s as quoteSqlLiteral } from "./sql-0WjxIp9g.js";
 import { a as scopeMembershipTable } from "./compile-EzEMB-7v.js";
 import { d as keptKeys, r as PERMDOCK_SCHEMA } from "./sources-C4vkzZJV.js";
@@ -25,10 +25,10 @@ import { t as parseCatalog } from "./parse-1_ZheTW5.js";
 import { n as activeTenantMismatch } from "./active-tenant-DVee32-T.js";
 import "./markers-BeHZ4x9Q.js";
 import { t as didYouMean } from "./args-0FrVs5EH.js";
-import { t as DOCS_BASE } from "./manifest-BWIR_EEB.js";
+import { t as DOCS_BASE } from "./manifest-Cft51TLK.js";
 import { t as createStyle } from "./style-Ds11Hmk4.js";
-import { a as nonEmptyOr, r as findingOf } from "./output-3iB3_Hfg.js";
-import { i as runSkillsInstall } from "./skills-CY-MY_Oj.js";
+import { a as nonEmptyOr, r as findingOf } from "./output-DlICTjBh.js";
+import { i as runSkillsInstall } from "./skills-Celu2W6v.js";
 import { n as MIGRATION_DIRS, t as DEFAULT_SENSITIVE_ACTIONS } from "./constants-DcJABbLW.js";
 import { l as partPath } from "./output-files-BIQ_9pIs.js";
 import { _ as readSupabaseConfig, a as supabaseHookManifest, c as activeSource, d as resolveSchemas, g as pd074, h as pd045, l as pd039, m as attrsPlan, n as hookOut, v as supabaseConfig } from "./supabase-hook-HPgwYb9V.js";
@@ -38,10 +38,10 @@ import { t as membershipSourcesOf } from "./sources-qoIJQrJv.js";
 import { i as group, n as membershipColumns, o as sqlStatements, r as tableKey } from "./deciding-columns-NB4wcyBf.js";
 import { t as FIELD_VIEWS } from "./fields-DI8s3cPl.js";
 import { t as resolveNames } from "./resolve-names-Y1Cb22cp.js";
-import { a as pd010, c as pd014, d as pd038, f as pd041, i as pd008, l as pd015, n as pd001, o as pd011, p as pd057, r as pd007, s as pd013, t as runUsage, u as pd036 } from "./usage-WYRc7Kqg.js";
-import { d as rowConditionMessage, f as commandFor, m as tableFor, p as compileGrants, s as ROW_CONDITION_FIX, u as helperTablePolicies } from "./verify-CHQgLrtS.js";
-import { a as streamOf, i as scopeSourcesOf, r as staleFiles, t as powersyncFiles } from "./powersync-DVbskWD9.js";
-import { a as buildContext, n as generateOptions, r as isRefusal, s as inheritTargets, t as supautilsRejections } from "./supautils-DZ95xxW-.js";
+import { a as pd010, c as pd014, d as pd038, f as pd041, i as pd008, l as pd015, n as pd001, o as pd011, p as pd057, r as pd007, s as pd013, t as runUsage, u as pd036 } from "./usage-CPXeuAdT.js";
+import { d as rowConditionMessage, f as commandFor, m as tableFor, p as compileGrants, s as ROW_CONDITION_FIX, u as helperTablePolicies } from "./verify-DfT0QYNh.js";
+import { a as streamOf, i as scopeSourcesOf, r as staleFiles, t as powersyncFiles } from "./powersync-CBhTBhG2.js";
+import { a as buildContext, n as generateOptions, r as isRefusal, s as inheritTargets, t as supautilsRejections } from "./supautils-SwE642N1.js";
 import { n as legacyHelperNames, r as retirePlan, t as legacyHelperCalls } from "./retire-B2xffQgY.js";
 import { basename, dirname, join, resolve } from "node:path";
 import { pathToFileURL } from "node:url";
@@ -222,17 +222,18 @@ function activeTenantOf(config) {
 async function pd078(input) {
 	if (input.config.supabase?.hook === void 0) return [];
 	const config = await betterSupabaseConfig(input);
-	const activeTenant = config === void 0 ? void 0 : activeTenantOf(config);
+	if (config === void 0) return [];
+	const activeTenant = activeTenantOf(config);
 	if (activeTenant === void 0) return [];
 	const policy = await policyOf(input);
 	const root = policy === void 0 ? void 0 : rootScope(scopeList(policy.scopes));
 	let from;
 	try {
-		from = activeSource(betterSupabaseDefaults(input.config, config !== void 0).supabase?.hook?.activeFrom, root ?? "tenant");
+		from = activeSource(betterSupabaseDefaults(input.config, config).supabase?.hook?.activeFrom, root ?? "tenant");
 	} catch {
 		return [];
 	}
-	const mismatch = activeTenantMismatch(from, input.config.rls?.tenantClaim ?? "tenant_id", activeTenant);
+	const mismatch = activeTenantMismatch(from, betterSupabaseTenantClaim(input.config, config), activeTenant);
 	return mismatch === void 0 ? [] : [{
 		code: "PD078",
 		severity: "warning",

package/dist/{import-efm6qPgx.js → import-Dfe2unKO.js}

@@ -4,7 +4,7 @@ import { i as readJsonFile } from "./files-BSjrtIHw.js";
 import { t as applyFiles } from "./files-B3AA05f1.js";
 import { n as httpRequest } from "./http-DOL33cO0.js";
 import { i as schemaExpression, t as emitPermissionsModule } from "./generate-CezbCaTI.js";
-import { t as validateOpenapi } from "./schema-CnrIP94n.js";
+import { t as validateOpenapi } from "./schema-DvXvxPhQ.js";
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";
 //#region ../../node_modules/.pnpm/yaml@2.9.1/node_modules/yaml/browser/dist/nodes/identity.js

package/dist/{init-D6rpLPwM.js → init-BUo2G-FI.js}

@@ -1,6 +1,6 @@
 import { n as CliError } from "./errors-Vpu6rKHl.js";
 import { a as decodePreset, g as resolvePreset, i as presetFlags, n as generatePreset, o as encodePreset } from "./preset-BjLzeFpp.js";
-import { a as nonEmptyOr } from "./output-3iB3_Hfg.js";
+import { a as nonEmptyOr } from "./output-DlICTjBh.js";
 import { t as addLine } from "./peer-Q0fuZ6hx.js";
 import { t as applyFiles } from "./files-B3AA05f1.js";
 import { existsSync } from "node:fs";

package/dist/{init-BtWY1L0J.js → init-C6cWP3xW.js}

@@ -48,7 +48,7 @@ const init = defineLeaf({
 		...forceFlag
 	},
 	async run(ctx, { flags }) {
-		const [{ runInit }, { packageManagerOf }] = await Promise.all([import("./init-D6rpLPwM.js"), import("./peer-C9LvBCcb.js")]);
+		const [{ runInit }, { packageManagerOf }] = await Promise.all([import("./init-BUo2G-FI.js"), import("./peer-C9LvBCcb.js")]);
 		const agent = await packageManagerOf(ctx.cwd);
 		const selection = {
 			archetype: flags.archetype,
@@ -79,7 +79,7 @@ const presetDecode = defineLeaf({
 	positionals: presetCode,
 	flags: {},
 	async run(_ctx, { args }) {
-		const { runPreset } = await import("./init-D6rpLPwM.js");
+		const { runPreset } = await import("./init-BUo2G-FI.js");
 		return runPreset("decode", args["code"] ?? "");
 	}
 });
@@ -87,7 +87,7 @@ const presetUrl = defineLeaf({
 	positionals: presetCode,
 	flags: {},
 	async run(_ctx, { args }) {
-		const { runPreset } = await import("./init-D6rpLPwM.js");
+		const { runPreset } = await import("./init-BUo2G-FI.js");
 		return runPreset("url", args["code"] ?? "");
 	}
 });

package/dist/{login-cLflB63Z.js → login-D1MHOomI.js}

@@ -3,7 +3,7 @@ import { n as CliError } from "./errors-Vpu6rKHl.js";
 import { i as postForm, r as parseToken, s as runDeviceFlow } from "./device-BwbJNmb2.js";
 import { i as writeCredentials, n as deleteCredentials, r as readCredentials, t as credentialsPath } from "./storage-C2bWdvJH.js";
 import { n as randomToken, t as pkce } from "./pkce-CnmmYqUZ.js";
-import { a as nonEmptyOr } from "./output-3iB3_Hfg.js";
+import { a as nonEmptyOr } from "./output-DlICTjBh.js";
 import { n as httpRequest } from "./http-DOL33cO0.js";
 import { c as READ_SCOPES, d as issuerMetadata, i as credentialsInsideRepository, l as cloudUrl, n as cliRuntime, r as credentialStorage, s as CLI_CLIENT_ID, t as CREDENTIAL_SERVICE } from "./auth--yPyZNgr.js";
 import { spawn } from "node:child_process";

package/dist/{login-B8s6VI8Z.js → login-DCKE5pVy.js}

@@ -27,7 +27,7 @@ const login = defineLeaf({
 		}
 	},
 	async run(ctx, { flags }) {
-		const { runLogin } = await import("./login-cLflB63Z.js");
+		const { runLogin } = await import("./login-D1MHOomI.js");
 		return runLogin({
 			cwd: ctx.cwd,
 			url: given(flags.url),
@@ -43,7 +43,7 @@ const login = defineLeaf({
 const logout = defineLeaf({
 	flags: { ...urlFlag },
 	async run(ctx, { flags }) {
-		const { runLogout } = await import("./login-cLflB63Z.js");
+		const { runLogout } = await import("./login-D1MHOomI.js");
 		return runLogout({
 			url: given(flags.url),
 			json: ctx.json,
@@ -55,7 +55,7 @@ const logout = defineLeaf({
 const whoami = defineLeaf({
 	flags: { ...urlFlag },
 	async run(ctx, { flags }) {
-		const { runWhoami } = await import("./login-cLflB63Z.js");
+		const { runWhoami } = await import("./login-D1MHOomI.js");
 		return runWhoami({
 			url: given(flags.url),
 			json: ctx.json,

package/dist/{manifest-BWIR_EEB.js → manifest-Cft51TLK.js}

@@ -30,20 +30,20 @@ const SECTIONS = [
 				docs: "init",
 				effects: ["files"],
 				config: false,
-				load: async () => (await import("./init-BtWY1L0J.js")).init
+				load: async () => (await import("./init-C6cWP3xW.js")).init
 			}),
 			group("preset", "Decode a preset code, or print its permdock.com/create link", "preset", [leaf("decode", "Print what a preset code holds", {
 				examples: ["permdock preset decode p1AQIDBAc"],
 				docs: "preset",
 				effects: [],
 				config: false,
-				load: async () => (await import("./init-BtWY1L0J.js")).presetDecode
+				load: async () => (await import("./init-C6cWP3xW.js")).presetDecode
 			}), leaf("url", "Print the permdock.com/create link that opens a code", {
 				examples: ["permdock preset url p1AQIDBAc"],
 				docs: "preset",
 				effects: [],
 				config: false,
-				load: async () => (await import("./init-BtWY1L0J.js")).presetUrl
+				load: async () => (await import("./init-C6cWP3xW.js")).presetUrl
 			})]),
 			group("skills", "Install, update or list the PermDock Agent Skills", "skills", [
 				leaf("install", "Copy the Agent Skills into the agent folders", {
@@ -55,21 +55,21 @@ const SECTIONS = [
 					docs: "skills",
 					effects: ["files"],
 					config: false,
-					load: async () => (await import("./skills-uzsVqEi9.js")).install
+					load: async () => (await import("./skills-B2qTbaQa.js")).install
 				}),
 				leaf("update", "Replace installed skills with this version's", {
 					examples: ["permdock skills update"],
 					docs: "skills",
 					effects: ["files"],
 					config: false,
-					load: async () => (await import("./skills-uzsVqEi9.js")).update
+					load: async () => (await import("./skills-B2qTbaQa.js")).update
 				}),
 				leaf("list", "List the skills and where each is installed", {
 					examples: ["permdock skills list"],
 					docs: "skills",
 					effects: [],
 					config: false,
-					load: async () => (await import("./skills-uzsVqEi9.js")).list
+					load: async () => (await import("./skills-B2qTbaQa.js")).list
 				})
 			]),
 			leaf("doctor", "Check a PermDock installation and print a fix for each finding", {
@@ -82,7 +82,7 @@ const SECTIONS = [
 				effects: ["files"],
 				config: true,
 				findings: true,
-				load: async () => (await import("./doctor-NxCr_hba.js")).doctor
+				load: async () => (await import("./doctor-CwYc2lJb.js")).doctor
 			}),
 			leaf("completion", "Print the shell completion script for bash, zsh or fish", {
 				examples: ["permdock completion zsh > ~/.zfunc/_permdock", "eval \"$(permdock completion bash)\""],
@@ -90,7 +90,7 @@ const SECTIONS = [
 				effects: [],
 				config: false,
 				shellOutput: true,
-				load: async () => (await import("./completion-fJ19i8Jk.js")).completion
+				load: async () => (await import("./completion--Y4YItFZ.js")).completion
 			})
 		]
 	},
@@ -106,7 +106,7 @@ const SECTIONS = [
 				docs: "collect",
 				effects: ["files"],
 				config: true,
-				load: async () => (await import("./collect-lZgCKMe_.js")).collect
+				load: async () => (await import("./collect-DnXL4B8c.js")).collect
 			}),
 			leaf("catalog", "Export the catalog as catalog JSON, JSON Schema or Markdown", {
 				examples: ["permdock catalog --out permissions.catalog.json", "permdock catalog --kind markdown"],
@@ -132,7 +132,7 @@ const SECTIONS = [
 				effects: [],
 				config: true,
 				findings: true,
-				load: async () => (await import("./usage-Dm2hn0pS.js")).usage
+				load: async () => (await import("./usage-CfZCQd0F.js")).usage
 			}),
 			leaf("diff", "Compare two policies or catalogs; exit 1 on a breaking change", {
 				examples: ["permdock diff main.catalog.json permissions.catalog.json", "permdock diff ./old-policy.ts ./src/policy.ts --impact"],
@@ -147,7 +147,7 @@ const SECTIONS = [
 				effects: [],
 				config: true,
 				findings: true,
-				load: async () => (await import("./config-BYSk3iKV.js")).config
+				load: async () => (await import("./config-BQ77xMZk.js")).config
 			})
 		]
 	},
@@ -164,14 +164,14 @@ const SECTIONS = [
 						"network"
 					],
 					config: true,
-					load: async () => (await import("./rls-DjjOHlKE.js")).generate
+					load: async () => (await import("./rls-C5ZGzR_B.js")).generate
 				}),
 				leaf("import", "Turn existing RLS policies into a generated definition", {
 					examples: ["permdock rls import --sql schema.sql --out src/permissions.generated.ts", "permdock rls import --db-url-stdin --out src/permissions.generated.ts"],
 					docs: "rls",
 					effects: ["files", "database:read"],
 					config: true,
-					load: async () => (await import("./rls-DjjOHlKE.js")).importPolicies
+					load: async () => (await import("./rls-C5ZGzR_B.js")).importPolicies
 				}),
 				leaf("verify", "Run the fixtures against the policies, or compare a live database", {
 					examples: [
@@ -183,21 +183,21 @@ const SECTIONS = [
 					effects: ["files", "database:read"],
 					config: true,
 					findings: true,
-					load: async () => (await import("./rls-DjjOHlKE.js")).verify
+					load: async () => (await import("./rls-C5ZGzR_B.js")).verify
 				}),
 				leaf("migrate", "Rewrite hand-written policies onto the generated helpers", {
 					examples: ["permdock rls migrate --sql supabase/migrations --dry-run", "permdock rls migrate --sql supabase/migrations"],
 					docs: "rls",
 					effects: ["rewrite", "files"],
 					config: true,
-					load: async () => (await import("./rls-DjjOHlKE.js")).migrate
+					load: async () => (await import("./rls-C5ZGzR_B.js")).migrate
 				}),
 				leaf("explain", "Show the tables, membership sources and triggers the SQL binds to", {
 					examples: ["permdock rls explain", "permdock rls explain --db-url-stdin --json"],
 					docs: "rls",
 					effects: ["database:read"],
 					config: true,
-					load: async () => (await import("./rls-DjjOHlKE.js")).explain
+					load: async () => (await import("./rls-C5ZGzR_B.js")).explain
 				})
 			]),
 			group("supabase", "Generate the Supabase Custom Access Token Hook, or inspect its manifest", "supabase", [group("hook", "The Custom Access Token Hook", "supabase", [leaf("generate", "Compile the membership sources into the hook migration", {
@@ -218,13 +218,13 @@ const SECTIONS = [
 				docs: "powersync",
 				effects: ["files"],
 				config: true,
-				load: async () => (await import("./powersync-COjQTHRD.js")).generate
+				load: async () => (await import("./powersync-DAfo0EL5.js")).generate
 			}), leaf("verify", "Fail on stale streams or a stream that syncs a denied row", {
 				examples: ["permdock powersync verify", "permdock powersync verify --db-url-stdin"],
 				docs: "powersync",
 				effects: ["database:read"],
 				config: true,
-				load: async () => (await import("./powersync-COjQTHRD.js")).verify
+				load: async () => (await import("./powersync-DAfo0EL5.js")).verify
 			})]),
 			group("scim", "Generate the Postgres tables postgresDirectoryStore keeps a SCIM directory in", "scim", [leaf("generate", "Write the tenant-keyed users, groups and members tables", {
 				examples: [
@@ -247,13 +247,13 @@ const SECTIONS = [
 				docs: "openapi",
 				effects: ["files"],
 				config: true,
-				load: async () => (await import("./openapi-CT55v3WD.js")).emit
+				load: async () => (await import("./openapi-BwWkHxvW.js")).emit
 			}), leaf("import", "Turn an OpenAPI document into a generated definition", {
 				examples: ["permdock openapi import --doc openapi.yaml --out src/permissions.generated.ts"],
 				docs: "openapi",
 				effects: ["files", "network"],
 				config: false,
-				load: async () => (await import("./openapi-CT55v3WD.js")).importDocument
+				load: async () => (await import("./openapi-BwWkHxvW.js")).importDocument
 			})]),
 			group("arazzo", "Check Arazzo workflows against the permissions", "arazzo", [leaf("check", "Resolve every Arazzo step to x-permdock-permissions", {
 				examples: ["permdock arazzo check --doc arazzo.json --openapi openapi.json"],
@@ -261,7 +261,7 @@ const SECTIONS = [
 				effects: [],
 				config: true,
 				findings: true,
-				load: async () => (await import("./arazzo-Bol9OgF-.js")).check
+				load: async () => (await import("./arazzo-CHoYnQXO.js")).check
 			})]),
 			leaf("scan", "List authorization checks written without PermDock, to adopt it in an existing app", {
 				examples: ["permdock scan", "permdock scan --src app,lib --pattern isBeta"],
@@ -269,7 +269,7 @@ const SECTIONS = [
 				effects: [],
 				config: true,
 				findings: true,
-				load: async () => (await import("./scan-CR_xm71k.js")).scan
+				load: async () => (await import("./scan-C3HRH9Fs.js")).scan
 			}),
 			group("casl", "Import CASL rules into a generated module", "casl", [leaf("import", "Turn CASL rules per role into a permissions and policy module", {
 				examples: ["permdock casl import --rules rules.json --out src/permissions.generated.ts"],
@@ -283,7 +283,7 @@ const SECTIONS = [
 				docs: "casbin",
 				effects: ["files"],
 				config: false,
-				load: async () => (await import("./casbin-1PVgMHOR.js")).casbinImport
+				load: async () => (await import("./casbin-D_rVQ31U.js")).casbinImport
 			})])
 		]
 	},
@@ -295,34 +295,34 @@ const SECTIONS = [
 				docs: "login",
 				effects: ["network", "files"],
 				config: false,
-				load: async () => (await import("./login-B8s6VI8Z.js")).login
+				load: async () => (await import("./login-DCKE5pVy.js")).login
 			}),
 			leaf("logout", "Revoke and delete the stored PermDock Cloud login", {
 				examples: ["permdock logout"],
 				docs: "login",
 				effects: ["network", "files"],
 				config: false,
-				load: async () => (await import("./login-B8s6VI8Z.js")).logout
+				load: async () => (await import("./login-DCKE5pVy.js")).logout
 			}),
 			leaf("whoami", "Print the PermDock Cloud identity the CLI acts as", {
 				examples: ["permdock whoami", "permdock whoami --json"],
 				docs: "login",
 				effects: [],
 				config: false,
-				load: async () => (await import("./login-B8s6VI8Z.js")).whoami
+				load: async () => (await import("./login-DCKE5pVy.js")).whoami
 			}),
 			group("cloud", "Publish to or pull from a PermDock Cloud project", "cloud", [leaf("push", "Publish the catalog, policy and manifest to a Cloud project", {
 				examples: ["permdock cloud push --dry-run", "permdock cloud push --project prj_123"],
 				docs: "cloud",
 				effects: ["network", "cloud:write"],
 				config: true,
-				load: async () => (await import("./cloud-BfJVKpcN.js")).push
+				load: async () => (await import("./cloud-DdaJ7ILM.js")).push
 			}), leaf("pull", "Write a Cloud project's published catalog and manifest", {
 				examples: ["permdock cloud pull --project prj_123"],
 				docs: "cloud",
 				effects: ["network", "files"],
 				config: true,
-				load: async () => (await import("./cloud-BfJVKpcN.js")).pull
+				load: async () => (await import("./cloud-DdaJ7ILM.js")).pull
 			})])
 		]
 	},
@@ -333,7 +333,7 @@ const SECTIONS = [
 			docs: "codemod",
 			effects: ["rewrite"],
 			config: false,
-			load: async () => (await import("./codemod-DWfH-KHk.js")).codemod
+			load: async () => (await import("./codemod-B1USJS7a.js")).codemod
 		})]
 	}
 ];
@@ -345,7 +345,7 @@ const COMPLETE_LEAF = leaf("__complete", "Print completion candidates for a part
 	config: false,
 	shellOutput: true,
 	hidden: true,
-	load: async () => (await import("./completion-fJ19i8Jk.js")).complete
+	load: async () => (await import("./completion--Y4YItFZ.js")).complete
 });
 const ROOT = group("permdock", "Collect, export, diff and check the permissions a PermDock policy declares", "", [...SECTIONS.flatMap((section) => section.entries), COMPLETE_LEAF]);
 /** Each leaf with its path from the root, in manifest order. */