permdock 0.16.0 → 0.17.0

package/dist/next/index.js

@@ -3,13 +3,15 @@ import { n as PermDockValidationError } from "../validation-error-CYg2kJEw.js";
 import { o as statusProblem, t as notFoundDetails } from "../problem-details-CLDgX1KV.js";
 import { n as isThenable } from "../thenable-BNSM1U2R.js";
 import { n as resourceRef } from "../resource-ref-CaS9yVPi.js";
-import { l as withApp } from "../permdock-BvjivVb9.js";
-import { n as wrapPermDock } from "../wrap-B2wziJI_.js";
+import { a as permissionStates } from "../checks-fyDOhcz0.js";
+import { l as withApp } from "../permdock-DdzMv5-F.js";
+import { n as wrapPermDock } from "../wrap-C5PWzgkq.js";
 import { i as decisionProblem } from "../problem-BVLHFK33.js";
-import { s as resumeDecision } from "../helpers-DJicaG6f.js";
-import { n as snapshotHeaders, r as snapshotTag, t as cacheLifeFor } from "../snapshot-cache-Bx_4xC_6.js";
-import { n as resolveOrNull, t as buildInstance } from "../build-instance-BWXqwQYU.js";
-import { _ as LOAD_FAILED, o as evaluationsHandler, v as NO_GRANT } from "../evaluations-IBceAeKT.js";
+import { s as resumeDecision } from "../helpers-DNnZffrI.js";
+import { i as snapshotTag, n as snapshotHeaders, r as snapshotKey, t as cacheLifeFor } from "../snapshot-cache-B66h7FBK.js";
+import { n as resolveOrNull, t as buildInstance } from "../build-instance-lye7oEqf.js";
+import { n as NO_GRANT, t as LOAD_FAILED } from "../decision-CaG5_eNJ.js";
+import { o as evaluationsHandler } from "../evaluations-DG40eSJa.js";
 import { cache } from "react";
 import { jsx } from "react/jsx-runtime";
 import { forbidden, unauthorized, unstable_rethrow } from "#next/navigation";
@@ -113,16 +115,10 @@ function protectActionOf(deps) {
 //#endregion
 //#region src/next/provider.tsx
 function renderClientProvider(options) {
+	const { children, ...props } = options;
 	return /* @__PURE__ */ jsx(PermDockProvider, {
-		...compact({
-			snapshotPromise: options.snapshotPromise,
-			endpoint: options.endpoint,
-			tenant: options.tenant,
-			suspend: options.suspend,
-			defaults: options.defaults,
-			messages: options.messages
-		}),
-		children: options.children
+		...compact(props),
+		children
 	});
 }
 //#endregion
@@ -148,6 +144,13 @@ function defer(task) {
 		return false;
 	}
 }
+/** Read through `globalThis` so the entry loads on runtimes without `process`. */
+function isDevelopment() {
+	const proc = Reflect.get(globalThis, "process");
+	if (typeof proc !== "object" || proc === null) return false;
+	const env = Reflect.get(proc, "env");
+	return typeof env === "object" && env !== null && Reflect.get(env, "NODE_ENV") === "development";
+}
 function ignore() {}
 /**
 * Keeps the function alive until the sink has written and flushed: every
@@ -221,14 +224,31 @@ function createPermDock(policy, given) {
 			};
 		}
 	};
+	const getPermissions = async (checks, query) => {
+		let permdock;
+		try {
+			permdock = await getPermDock(query);
+		} catch (error) {
+			unstable_rethrow(error);
+		}
+		if (permdock === void 0) return permissionStates(() => NO_GRANT, checks);
+		const decide = permdock.decide;
+		return permissionStates(decide, checks);
+	};
+	let warnedShortLife = false;
 	const getSnapshot = async (query = {}) => {
 		const permdock = await getPermDock(compact({ tenant: query.tenant }));
 		const snapshot = permdock.snapshot(compact({
 			include: query.include,
 			tenants: query.tenants
 		}));
+		const life = cacheLifeFor(snapshot, query.cacheLife);
+		if (life.stale < 300 && !warnedShortLife && isDevelopment()) {
+			warnedShortLife = true;
+			console.warn(`PermDock: getSnapshot() caches for ${String(life.stale)} s; Next.js drops a private entry under 300 s from the App Shell prefetch.`);
+		}
 		try {
-			cacheLife(cacheLifeFor(snapshot));
+			cacheLife(life);
 			cacheTag(snapshotTag(permdock.subject.principal?.id), ...query.tags ?? []);
 		} catch (error) {
 			unstable_rethrow(error);
@@ -255,15 +275,12 @@ function createPermDock(policy, given) {
 			include: props.include,
 			tenants: props.tenants
 		})));
-		return renderClientProvider(compact({
+		const { snapshot: _snapshot, include: _include, tenants: _tenants, ...rest } = props;
+		return renderClientProvider({
+			...rest,
 			snapshotPromise,
-			endpoint: props.endpoint ?? options.endpoint ?? "/api/permdock",
-			tenant: props.tenant,
-			suspend: props.suspend,
-			defaults: props.defaults,
-			messages: props.messages,
-			children: props.children
-		}));
+			endpoint: props.endpoint ?? options.endpoint ?? "/api/permdock"
+		});
 	};
 	const permdockHandler = () => evaluationsHandler(compact({
 		policy,
@@ -273,6 +290,7 @@ function createPermDock(policy, given) {
 	return {
 		getPermDock,
 		getPermission,
+		getPermissions,
 		getSnapshot,
 		requirePermission,
 		PermDockProvider,
@@ -286,4 +304,4 @@ function createPermDock(policy, given) {
 	};
 }
 //#endregion
-export { cacheLifeFor, createPermDock, snapshotHeaders, snapshotTag };
+export { cacheLifeFor, createPermDock, snapshotHeaders, snapshotKey, snapshotTag };

package/dist/next/plugin.d.ts

@@ -1,4 +1,4 @@
-import { s as PermDockPluginOptions } from "../types-Cklw5hJo.js";
+import { s as PermDockPluginOptions } from "../types-CAAN7evk.js";
 //#region src/cli/plugin.d.ts
 /** Any object: Next's `NextConfig` is an interface, so no index signature. */
 type NextConfigLike = object;

package/dist/next/plugin.js

@@ -1,5 +1,5 @@
-import { a as describeError } from "../errors-Vpu6rKHl.js";
-import { n as createCollectScheduler, r as report, t as collectOnce } from "../watch-DAkjm75Y.js";
+import { a as describeError } from "../errors-BhRkoNS7.js";
+import { n as createCollectScheduler, r as report, t as collectOnce } from "../watch-DXRDBSCu.js";
 //#region src/cli/plugin.ts
 const PHASE_BUILD = "phase-production-build";
 const PHASE_DEV = "phase-development-server";

package/dist/node/index.d.ts

@@ -1,8 +1,8 @@
-import { T as Policy, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
+import { E as Policy, M as PolicyVocabulary, _r as Principal } from "../policy-types-IRJVABmm.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { a as PermDock } from "../permdock-CprAPN3w.js";
-import { f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, r as Guard, s as ScopeGuard, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CyRN0-Cd.js";
-import { t as ServerAdapterOptions } from "../bind-YYjvfpB9.js";
+import { a as PermDock } from "../permdock-DUWZEOLR.js";
+import { f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, r as Guard, s as ScopeGuard, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-Bw-lWqzR.js";
+import { t as ServerAdapterOptions } from "../bind-DjFNX0Pq.js";
 import { i as toRequest, n as isServerResponse, r as sendResponse, t as NodeRequest } from "../http-B_LphE5Y.js";
 import { IncomingMessage, ServerResponse } from "node:http";
 //#region src/node/create.d.ts

package/dist/node/index.js

@@ -1,5 +1,5 @@
-import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-IBceAeKT.js";
-import { r as bindKernel } from "../bind-BNQA9JK9.js";
+import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-DG40eSJa.js";
+import { r as bindKernel } from "../bind-BJFeLX1V.js";
 import { n as sendResponse, r as toRequest, t as isServerResponse } from "../http-DH94eh6f.js";
 //#region src/node/create.ts
 const nodeRequest = (req) => req;

package/dist/openai/index.d.ts

@@ -1,8 +1,8 @@
-import { T as Policy, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
+import { E as Policy, M as PolicyVocabulary, _r as Principal } from "../policy-types-IRJVABmm.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { a as PermDock } from "../permdock-CprAPN3w.js";
-import { u as ApprovalRequest } from "../types-DLvhVm1r.js";
-import { o as AgentAdapterOptions, t as AgentPermDock } from "../create-BPUopdfL.js";
+import { a as PermDock } from "../permdock-DUWZEOLR.js";
+import { u as ApprovalRequest } from "../types-BvBbkAu1.js";
+import { o as AgentAdapterOptions, t as AgentPermDock } from "../create-bzQlBzG4.js";
 //#region src/openai/create.d.ts
 /** The app context passed to `run(agent, input, { context })`. */
 type OpenAiContext = {

package/dist/openai/index.js

@@ -1,7 +1,7 @@
 import { t as compact } from "../compact-CAf557ZB.js";
-import { l as withApp } from "../permdock-BvjivVb9.js";
-import { t as approvalTokenOf } from "../kernel-BD8QuMnv.js";
-import { t as agentRuntime } from "../create-Coq5fIrq.js";
+import { l as withApp } from "../permdock-DdzMv5-F.js";
+import { t as approvalTokenOf } from "../kernel-CDDU93dI.js";
+import { t as agentRuntime } from "../create-gqtDb1nU.js";
 //#region src/openai/create.ts
 function appContext(runContext) {
 	const context = runContext?.context;

package/dist/openapi/index.d.ts

@@ -1,6 +1,6 @@
-import { T as Policy, br as Condition, pr as Principal } from "../policy-types-DGIO_gxq.js";
+import { E as Policy, _r as Principal, wr as Condition } from "../policy-types-IRJVABmm.js";
 import { f as PermissionTree, u as Permission } from "../permission-types-CAY-GU7e.js";
-import { a as ProblemDetails } from "../errors-BIM4MFsJ.js";
+import { a as ProblemDetails } from "../errors-Dc9FdamT.js";
 import { StandardJSONSchemaV1, StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/openapi/types.d.ts
 type OpenApiTarget = "3.1" | "3.2" | "3.3";

package/dist/{openapi-BwWkHxvW.js → openapi-D3wkvOoU.js}

@@ -1,6 +1,6 @@
-import { c as missingInput } from "./errors-Vpu6rKHl.js";
+import { c as missingInput } from "./errors-BhRkoNS7.js";
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { c as given, d as policyFlag, f as validatorFlag, l as outFlag, o as fileOut, t as checkFlag } from "./flags-DXjoTVbS.js";
+import { c as given, d as policyFlag, f as validatorFlag, l as outFlag, o as fileOut, t as checkFlag } from "./flags-BlmpmXoY.js";
 //#region src/cli/commands/openapi.ts
 const docFlag = { doc: {
 	type: "string",
@@ -80,7 +80,7 @@ const emit = defineLeaf({
 		}
 	},
 	async run(ctx, { flags }) {
-		return (await import("./openapi-DSzQN7Zu.js")).runOpenapi({
+		return (await import("./openapi-GM-kTdkq.js")).runOpenapi({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			rest: ["emit"],
@@ -122,7 +122,7 @@ const importDocument = defineLeaf({
 	async run(ctx, { flags }) {
 		const doc = given(flags.doc);
 		if (doc === void 0) throw missingInput("openapi import", ["--doc"], "the OpenAPI document to import");
-		return (await import("./import-Dfe2unKO.js")).runOpenapiImport({
+		return (await import("./import-BYVbSKx0.js")).runOpenapiImport({
 			cwd: ctx.cwd,
 			doc,
 			out: fileOut("openapi import", flags.out),

package/dist/{openapi-DSzQN7Zu.js → openapi-GM-kTdkq.js}

@@ -1,13 +1,13 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
 import { a as getResource, n as findPermission } from "./permission-registry-B8tYxPIt.js";
-import { r as definePolicy } from "./policy-CLQ8__GF.js";
-import { i as configError } from "./errors-Vpu6rKHl.js";
+import { r as definePolicy } from "./policy-DxQyHKPB.js";
+import { i as configError } from "./errors-BhRkoNS7.js";
 import { i as readJsonFile, s as writeFileEnsuringDir } from "./files-BSjrtIHw.js";
-import { a as loadModule, n as asPolicy, s as pickNamed, t as asPermissionTree } from "./load-DjSU5KXO.js";
+import { a as loadModule, n as asPolicy, s as pickNamed, t as asPermissionTree } from "./load-BaEamml-.js";
 import { t as shortDiff } from "./text-diff-BtfSmdUo.js";
 import { c as openapiVersion, o as createPermDock } from "./openapi-BOsx0xn9.js";
-import { i as fileDrift } from "./output-files-BIQ_9pIs.js";
-import { n as validateOverlay, t as validateOpenapi } from "./schema-DvXvxPhQ.js";
+import { i as fileDrift } from "./output-files-CM0BnH05.js";
+import { n as validateOverlay, t as validateOpenapi } from "./schema-9_NDz8fx.js";
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 //#region src/cli/openapi/openapi.ts

package/dist/orpc/index.d.ts

@@ -1,11 +1,11 @@
-import { T as Policy, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
+import { E as Policy, M as PolicyVocabulary, _r as Principal } from "../policy-types-IRJVABmm.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
 import { a as OperationInput, t as Operation } from "../operations-Ci_rT6Uo.js";
-import { a as PermDock } from "../permdock-CprAPN3w.js";
+import { a as PermDock } from "../permdock-DUWZEOLR.js";
 import { n as RevocationFeed } from "../revocations-BaUXHM1N.js";
-import { D as ConnectionOptions, T as Connection, i as OpenApiHooks } from "../server-types-CyRN0-Cd.js";
-import { t as ServerAdapterOptions } from "../bind-YYjvfpB9.js";
-import { t as StreamProtectOptions } from "../stream-9y9qw51m.js";
+import { D as ConnectionOptions, T as Connection, i as OpenApiHooks } from "../server-types-Bw-lWqzR.js";
+import { t as ServerAdapterOptions } from "../bind-DjFNX0Pq.js";
+import { t as StreamProtectOptions } from "../stream-BMJg56jU.js";
 import { AnySchema, MetaPlugin, Middleware, Procedure, Schema } from "@orpc/server";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/orpc/operations.d.ts

package/dist/orpc/index.js

@@ -1,10 +1,10 @@
 import { t as compact } from "../compact-CAf557ZB.js";
 import { o as isPermission } from "../permission-registry-B8tYxPIt.js";
 import { o as problemMessage } from "../http-DKLXrFGk.js";
-import { t as problemFromError } from "../map-error-pasIGqMT.js";
-import { n as attached } from "../bind-BNQA9JK9.js";
+import { t as problemFromError } from "../map-error-B_f3C5cs.js";
+import { n as attached } from "../bind-BJFeLX1V.js";
 import { i as isAsyncIterable, o as reloadAfter } from "../stream-CDvF0sJm.js";
-import { i as rpcCode, n as guardStream, r as problemBody, t as bindRpcKernel } from "../rpc-vHIwyXCp.js";
+import { i as rpcCode, n as guardStream, r as problemBody, t as bindRpcKernel } from "../rpc-BOu3FD6X.js";
 import { ORPCError, os } from "@orpc/server";
 //#region src/orpc/operations.ts
 const root = os;

package/dist/otel/index.d.ts

@@ -1,6 +1,6 @@
-import { j as PolicyVocabulary } from "../policy-types-DGIO_gxq.js";
-import { a as PermDock } from "../permdock-CprAPN3w.js";
-import { a as OtelOptions, i as OtelApi, n as GEN_AI_TOOL_CALL_ID, o as OtelWrap, r as GEN_AI_TOOL_NAME, s as StructuralLogger, t as GENAI_SEMCONV_PIN } from "../types-B6ExllNo.js";
+import { M as PolicyVocabulary } from "../policy-types-IRJVABmm.js";
+import { a as PermDock } from "../permdock-DUWZEOLR.js";
+import { a as OtelOptions, i as OtelApi, n as GEN_AI_TOOL_CALL_ID, o as OtelWrap, r as GEN_AI_TOOL_NAME, s as StructuralLogger, t as GENAI_SEMCONV_PIN } from "../types-Sj1U8HMm.js";
 //#region src/otel/instrument.d.ts
 /**
  * Listens on one instance. Spans carry no duration and no histogram is

package/dist/otel/index.js

@@ -1,5 +1,5 @@
 import { t as compact } from "../compact-CAf557ZB.js";
-import { n as wrapPermDock } from "../wrap-B2wziJI_.js";
+import { n as wrapPermDock } from "../wrap-C5PWzgkq.js";
 import { r as appObligationNames } from "../ocsf-TcjRBgIs.js";
 //#region src/otel/types.ts
 const GENAI_SEMCONV_PIN = "1.37.0";

package/dist/{output-DlICTjBh.js → output-DhTpe8v1.js}

@@ -1,5 +1,5 @@
 import { s as cliVersion } from "./version-DMQ0dnN5.js";
-import { t as DOCS_BASE } from "./manifest-Cft51TLK.js";
+import { t as DOCS_BASE } from "./manifest-Dij1U0hx.js";
 //#region src/cli/core/output.ts
 const CLI_RESULT_SCHEMA = "https://permdock.com/schemas/cli-result-v1.json";
 function envelope(input) {

package/dist/output-files-BYscrQl-.js

@@ -0,0 +1 @@
+export { t as SPLIT_PARTS } from "./output-files-CM0BnH05.js";

package/dist/{output-files-BIQ_9pIs.js → output-files-CM0BnH05.js}

@@ -1,6 +1,6 @@
 import { i as dateAt } from "./time-nR1JesoH.js";
 import { t as shortDiff } from "./text-diff-BtfSmdUo.js";
-import { t as applyFiles } from "./files-B3AA05f1.js";
+import { t as applyFiles } from "./files-CfiRtQ-m.js";
 import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
 import { basename, dirname, resolve } from "node:path";
 /** How `path` on disk differs from `expected`; `undefined` when `same` holds. */

package/dist/{ownership-qqBuGJXr.js → ownership-moSRhxl_.js}

@@ -2,16 +2,16 @@ import { a as sole, n as isReadonlyArray, r as isRecord } from "./compact-CAf557
 import { n as isForbiddenKey } from "./paths-CUvURzHp.js";
 import { u as isSqlFunctionField } from "./refs-C8BKxc_e.js";
 import { u as isoAt } from "./time-nR1JesoH.js";
-import { f as scopeList, l as rootScope, s as resolveScope, u as scopeChain } from "./scopes-0Up_UA2t.js";
+import { c as rootScope, d as scopeList, l as scopeChain, s as resolveScope } from "./scopes-BSdYaGHs.js";
 import { t as isoInstant } from "./instant-DK3Iz83e.js";
 import { m as findRole, v as listRoles } from "./grantee-Dke-9rd1.js";
-import { r as relationCondition, t as inheritCondition } from "./grantee-conditions-BrYPe-w0.js";
-import { i as configError } from "./errors-Vpu6rKHl.js";
+import { r as relationCondition, t as inheritCondition } from "./grantee-conditions-DX4K_gGI.js";
+import { i as configError } from "./errors-BhRkoNS7.js";
 import { i as qualifySqlTable } from "./sql-0WjxIp9g.js";
-import { a as scopeMembershipTable, i as scopeColumn, s as relatedSql } from "./compile-EzEMB-7v.js";
+import { a as scopeMembershipTable, i as scopeColumn, s as relatedSql } from "./compile-B_oJqmIg.js";
 import { l as roleColumn } from "./sources-C4vkzZJV.js";
-import { A as quoteQualified, D as qualified, E as helperSchema, L as sqlType, M as textArrayLiteral, O as quoteIdent, R as tenantTypeOf, S as CLAIM, T as declaredArray, _ as subjectClaimJsonSql, b as tenantClaimSql, d as keyTenantSql, f as kindFilterSql, h as roleKindSql, j as quoteTable, k as quoteLiteral, m as memberVia, p as liveSessionSql, s as signedIn, t as CUSTOM_ROLES, u as globalKindFilterSql, v as subjectClaimSql, y as subjectIdSql } from "./shared-DrGLwM3s.js";
-import { $ as graphSqlText, A as claimKeptLines, B as hasCustomRoleChecksFor, F as globalRoleRows, I as membershipRows, L as roleRows, M as memberColumn, N as sourceFilters, P as sourcesKeep, U as storedTenant, X as CLOSURE, Z as graphHelper, _t as activeMembershipSql, c as holderSources, ct as memberIdsHelper, d as sourceRowsSql, f as sourceTransferTriggerSql, g as OWNERSHIP, gt as activeInstancesSql, h as ASSIGNMENTS, ht as scopeTable, it as linkHelper, j as disabledColumn, l as pairsSql, m as transferTriggerSql, mt as scopeSources, nt as inheritedRowsHelper, p as holdersTriggerSql, pt as restrictedHelper, st as memberForTable, u as sourceHoldersTriggerSql, ut as memberRoleOf, yt as activeUserSql } from "./tables-DimBcVWY.js";
+import { A as quoteQualified, D as qualified, E as helperSchema, L as sqlType, M as textArrayLiteral, O as quoteIdent, R as tenantTypeOf, S as CLAIM, T as declaredArray, _ as subjectClaimJsonSql, b as tenantClaimSql, d as keyTenantSql, f as kindFilterSql, h as roleKindSql, j as quoteTable, k as quoteLiteral, m as memberVia, p as liveSessionSql, s as signedIn, t as CUSTOM_ROLES, u as globalKindFilterSql, v as subjectClaimSql, y as subjectIdSql } from "./shared-DyYVEjKC.js";
+import { $ as graphSqlText, A as claimKeptLines, B as hasCustomRoleChecksFor, F as globalRoleRows, I as membershipRows, L as roleRows, M as memberColumn, N as sourceFilters, P as sourcesKeep, U as storedTenant, X as CLOSURE, Z as graphHelper, _t as activeMembershipSql, c as holderSources, ct as memberIdsHelper, d as sourceRowsSql, f as sourceTransferTriggerSql, g as OWNERSHIP, gt as activeInstancesSql, h as ASSIGNMENTS, ht as scopeTable, it as linkHelper, j as disabledColumn, l as pairsSql, m as transferTriggerSql, mt as scopeSources, nt as inheritedRowsHelper, p as holdersTriggerSql, pt as restrictedHelper, st as memberForTable, u as sourceHoldersTriggerSql, ut as memberRoleOf, yt as activeUserSql } from "./tables-BsGE6HBR.js";
 //#region src/cli/sql/conditions.ts
 const MAX_CLAIM_DEPTH = 8;
 /**

package/dist/{parse-1_ZheTW5.js → parse-UTC-sDrt.js}

@@ -1,9 +1,9 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-jjan0lCv.js";
 import { n as PermDockValidationError } from "./validation-error-CYg2kJEw.js";
-import { f as scopeList, s as resolveScope } from "./scopes-0Up_UA2t.js";
+import { d as scopeList, s as resolveScope } from "./scopes-BSdYaGHs.js";
 import { n as copyJson, t as checkSchema } from "./json-schema-BPGa-RjQ.js";
-import { t as catalogSchema } from "./schema-BOJjqlWL.js";
+import { t as catalogSchema } from "./schema-CuX70xgH.js";
 //#region src/catalog/references.ts
 function duplicates(issues, list, name, field) {
 	const seen = /* @__PURE__ */ new Set();

package/dist/{parse-local-manifest-CCmbhnxP.d.ts → parse-local-manifest-BgTYdR3q.d.ts}

@@ -1,4 +1,4 @@
-import { Yt as LocalSnapshotManifest } from "./policy-types-DGIO_gxq.js";
+import { Zt as LocalSnapshotManifest } from "./policy-types-IRJVABmm.js";
 //#region src/core/parse-local-manifest.d.ts
 /**
  * Whether `value` has the shape `localSnapshotManifest(policy)` writes, with no

package/dist/{parse-request-CwCZpyjV.js → parse-request-DOBVaeiQ.js}

@@ -1,6 +1,6 @@
 import { n as freezeDeep } from "./freeze-jjan0lCv.js";
 import { n as copyJson, r as forbiddenKeyPath, t as checkSchema } from "./json-schema-BPGa-RjQ.js";
-import { t as APPROVAL_REQUEST_SCHEMA } from "./request-schema-DhX7UbfQ.js";
+import { t as APPROVAL_REQUEST_SCHEMA } from "./request-schema-CMP8Cmxd.js";
 //#region src/approvals/parse-request.ts
 /**
 * Reads an `ApprovalRequest` (parsed, or the JSON text) as an approval store or

package/dist/pdp/index.d.ts

@@ -1,6 +1,6 @@
-import { T as Policy, j as PolicyVocabulary, pr as Principal, q as DecisionProvider } from "../policy-types-DGIO_gxq.js";
-import { o as PermDockOptions } from "../permdock-CprAPN3w.js";
-import { a as RelationMap, c as RemotePdpEndpoints, d as SpiceDbCheck, f as SpiceDbOptions, i as PdpPermDock, l as RemotePdpMapping, n as OpenFgaTuple, o as RemotePdpAuth, r as PdpFactory, s as RemotePdpCache, t as OpenFgaOptions, u as RemotePdpOptions } from "../types-DlelvQk4.js";
+import { E as Policy, J as DecisionProvider, M as PolicyVocabulary, _r as Principal } from "../policy-types-IRJVABmm.js";
+import { o as PermDockOptions } from "../permdock-DUWZEOLR.js";
+import { a as RelationMap, c as RemotePdpEndpoints, d as SpiceDbCheck, f as SpiceDbOptions, i as PdpPermDock, l as RemotePdpMapping, n as OpenFgaTuple, o as RemotePdpAuth, r as PdpFactory, s as RemotePdpCache, t as OpenFgaOptions, u as RemotePdpOptions } from "../types-B3BOcI0J.js";
 //#region src/pdp/create.d.ts
 /**
  * The PDP-aware instance, built synchronously like core `getPermDockSync`; use

package/dist/pdp/index.js

@@ -5,9 +5,9 @@ import { a as deniedMessage, i as approvalMessage, n as PermDockDeniedError, t a
 import { n as internalsOf, t as attachInternals } from "../internals-B3IgHrvo.js";
 import { a as getResource, c as listPermissions } from "../permission-registry-B8tYxPIt.js";
 import { n as toWireDelegation } from "../wire-delegation-Cv3W2eaM.js";
-import { r as decideAllAsync, t as canAllAsync } from "../checks-CGkP3Z7A.js";
-import { n as getPermDockSync$1, t as getPermDock$1 } from "../permdock-BvjivVb9.js";
-import { a as postJson, c as ttlMs, i as joinUrl, n as denied, o as resourceIdOf, r as granted, s as ttlCache, t as cacheKey } from "../shared-l0oGGetg.js";
+import { r as decideAllAsync, t as canAllAsync } from "../checks-fyDOhcz0.js";
+import { n as getPermDockSync$1, t as getPermDock$1 } from "../permdock-DdzMv5-F.js";
+import { a as postJson, c as ttlMs, i as joinUrl, n as denied, o as resourceIdOf, r as granted, s as ttlCache, t as cacheKey } from "../shared-BRmCJxDK.js";
 //#region src/pdp/create.ts
 function withoutProviders(policy) {
 	if (policy.providers === void 0 || policy.providers.length === 0) return policy;

package/dist/{peer-Q0fuZ6hx.js → peer-BuK9F53f.js}

@@ -1,4 +1,4 @@
-import { n as CliError } from "./errors-Vpu6rKHl.js";
+import { n as CliError } from "./errors-BhRkoNS7.js";
 import { readFileSync } from "node:fs";
 import path from "node:path";
 import { createRequire } from "node:module";

package/dist/{peer-C9LvBCcb.js → peer-n-swIV4H.js}

@@ -1 +1 @@
-export { t as addLine, n as packageManagerOf, r as peerHint, i as requirePeer } from "./peer-Q0fuZ6hx.js";
+export { t as addLine, n as packageManagerOf, r as peerHint, i as requirePeer } from "./peer-BuK9F53f.js";