permdock 0.16.0 → 0.17.0

package/dist/{codemod-ammy6wv4.js → codemod-DNGMGqBS.js}

@@ -1,12 +1,185 @@
-import { n as CliError } from "./errors-Vpu6rKHl.js";
+import { n as CliError } from "./errors-BhRkoNS7.js";
 import { a as rel } from "./files-BSjrtIHw.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
-import { n as ROOT } from "./manifest-Cft51TLK.js";
-import { i as renameMessage, n as DEFAULT_CHANGES, r as flagRename, t as COMMAND_MOVES } from "./renames-CGj7YwcQ.js";
-import { i as refuseDirty, t as applyFiles } from "./files-B3AA05f1.js";
+import { n as ROOT } from "./manifest-Dij1U0hx.js";
+import { i as refuseDirty, t as applyFiles } from "./files-CfiRtQ-m.js";
 import { readFileSync, readdirSync, statSync } from "node:fs";
 import { basename, extname, join, resolve } from "node:path";
 import { Visitor, parseSync, visitorKeys } from "oxc-parser";
+//#region src/cli/codemod/cli-renames-0.5.ts
+const DB_COMMANDS = [
+	"rls generate",
+	"rls import",
+	"rls verify",
+	"supabase hook generate",
+	"powersync verify"
+];
+const FLAG_RENAMES = [
+	{
+		commands: DB_COMMANDS,
+		from: "--db",
+		to: "--db-url-stdin",
+		hint: "--db-url-stdin or DATABASE_URL"
+	},
+	{
+		commands: DB_COMMANDS,
+		from: "--db-url",
+		to: "--db-url-stdin",
+		hint: "--db-url-stdin or DATABASE_URL"
+	},
+	{
+		commands: ["rls generate"],
+		from: "--force",
+		to: "--force-rls"
+	},
+	{
+		commands: ["rls verify"],
+		from: "--format",
+		to: "--kind"
+	},
+	{
+		commands: ["rls verify"],
+		from: "--emit",
+		to: "--kind"
+	},
+	{
+		commands: ["catalog"],
+		from: "--format",
+		to: "--kind",
+		values: {
+			json: "catalog",
+			schema: "json-schema",
+			markdown: "markdown"
+		}
+	},
+	{
+		commands: ["openapi emit"],
+		from: "--format",
+		to: "--kind"
+	},
+	{
+		commands: [
+			"rls generate",
+			"rls verify",
+			"rls migrate",
+			"powersync generate",
+			"powersync verify",
+			"openapi emit"
+		],
+		from: "--from",
+		to: "--policy"
+	},
+	{
+		commands: ["catalog", "arazzo check"],
+		from: "--from",
+		to: "--permissions"
+	},
+	{
+		commands: ["rls import", "openapi import"],
+		from: "--schema",
+		to: "--validator"
+	},
+	{
+		commands: [
+			"usage",
+			"config",
+			"doctor"
+		],
+		from: "--strict",
+		to: "--fail-on",
+		hint: "--fail-on warning",
+		rewrite: "--fail-on warning"
+	},
+	{
+		commands: ["login"],
+		from: "--write",
+		to: "--scope",
+		hint: "--scope catalog:write",
+		rewrite: "--scope catalog:write"
+	},
+	{
+		commands: ["skills install", "skills update"],
+		from: "--agent",
+		to: "--for"
+	},
+	{
+		commands: ["skills install", "skills update"],
+		from: "--client",
+		to: "--for"
+	},
+	{
+		commands: ["init"],
+		from: "--agent",
+		to: "--integration"
+	},
+	{
+		commands: ["init"],
+		from: "--ui",
+		to: "--integration"
+	},
+	{
+		commands: ["init"],
+		from: "--src",
+		to: "--out-dir"
+	},
+	{
+		commands: [
+			"rls generate",
+			"rls verify",
+			"rls migrate"
+		],
+		from: "--rbac-scaffold",
+		to: "--rbac",
+		hint: "--rbac supabase",
+		rewrite: "--rbac supabase"
+	},
+	{
+		commands: ["rls migrate"],
+		from: "--write",
+		hint: "rls migrate writes by default; --dry-run prints the plan without writing",
+		rewrite: ""
+	},
+	{
+		commands: ["cloud push"],
+		from: "--environment",
+		to: "--project",
+		hint: "--project <id>: a project id is its environment"
+	},
+	{
+		commands: ["scan"],
+		from: "--legacy",
+		hint: "permdock scan lists the checks written without PermDock; drop --legacy",
+		rewrite: ""
+	}
+];
+const COMMAND_MOVES = [
+	{
+		from: "openapi",
+		to: "openapi emit"
+	},
+	{
+		from: "skills",
+		to: "skills install"
+	},
+	{
+		from: "arazzo",
+		to: "arazzo check"
+	}
+];
+const DEFAULT_CHANGES = [{
+	command: "rls migrate",
+	unless: ["--write", "--retire-out"],
+	add: "--dry-run"
+}];
+/** The rename that matches `flag` (as typed, before any `=`) on `command`. */
+function flagRename(command, flag) {
+	return FLAG_RENAMES.find((rename) => rename.from === flag && rename.commands.includes(command));
+}
+function renameMessage(command, rename) {
+	const replacement = rename.hint ?? rename.to;
+	return replacement === void 0 ? `${command}: ${rename.from} was removed in 0.5.0.` : rename.to === void 0 ? `${command}: ${rename.from} was removed in 0.5.0: ${replacement}.` : `${command}: ${rename.from} is ${replacement} since 0.5.0.`;
+}
+//#endregion
 //#region src/cli/codemod/cli-calls.ts
 /**
 * `permdock`, `npx permdock@0.4`, `pnpm exec permdock`: the bin name followed
@@ -66,8 +239,7 @@ function flagEdits(command, tokens, notes) {
 	for (const [index, token] of tokens.entries()) {
 		if (!token.text.startsWith("--")) continue;
 		const eq = token.text.indexOf("=");
-		const name = eq === -1 ? token.text : token.text.slice(0, eq);
-		const rename = flagRename(command, name);
+		const rename = flagRename(command, eq === -1 ? token.text : token.text.slice(0, eq));
 		if (rename === void 0) continue;
 		const edit = flagEdit(rename, token, eq, tokens[index + 1]);
 		if (edit === void 0) notes.push({
@@ -1380,6 +1552,206 @@ const DURATION_KEYS_0_5 = Object.freeze({
 	lists: ["durations"]
 });
 //#endregion
+//#region src/cli/codemod/shapes-0.17.ts
+const COMBINATORS = /* @__PURE__ */ new Set([
+	"any",
+	"all",
+	"sequential"
+]);
+/** The keys a 0.16 membership literal may carry. */
+const MEMBERSHIP_KEYS = /* @__PURE__ */ new Set([
+	"tenant",
+	"team",
+	"roles",
+	"eligible",
+	"via",
+	"expiresAt",
+	"grantedBy",
+	"reason",
+	"member",
+	"managedBy",
+	"entitlements",
+	"keep",
+	"x"
+]);
+function keyed(object) {
+	const out = [];
+	for (const property of object.properties) {
+		if (property.type !== "Property" || property.computed) continue;
+		const { key } = property;
+		if (key.type === "Identifier") out.push({
+			key: key.name,
+			property
+		});
+		else if (key.type === "Literal" && typeof key.value === "string") out.push({
+			key: key.value,
+			property
+		});
+	}
+	return out;
+}
+function stringLiteral(property) {
+	const { value } = property;
+	return value.type === "Literal" && typeof value.value === "string" ? value.value : void 0;
+}
+function langOf(file) {
+	if (file.endsWith(".tsx")) return "tsx";
+	if (file.endsWith(".jsx")) return "jsx";
+	return /\.[cm]?ts$/u.test(file) ? "ts" : "js";
+}
+/**
+* The span of `property` with the comma after it, or the comma before it when
+* it is the last property, so removing the span leaves the object well formed.
+*/
+function withComma(source, property) {
+	const after = /^\s*,\s*/u.exec(source.slice(property.end));
+	if (after !== null) return {
+		start: property.start,
+		end: property.end + after[0].length
+	};
+	const before = /,\s*$/u.exec(source.slice(0, property.start));
+	return {
+		start: property.start - (before?.[0].length ?? 0),
+		end: property.end
+	};
+}
+/**
+* 0.17's object-literal rewrites:
+*
+* - A membership `{ tenant, team?, roles }` becomes `{ scope, id, within? }`
+*   under the `tenant` and `team` scope aliases. Only an object whose keys are
+*   all membership fields counts, so credentials, events and principals that
+*   carry `tenant` and `roles` stay as they are.
+* - An approval option's `mode: 'any' | 'all' | 'sequential'` becomes `combine`,
+*   `distinct: false` becomes `mode: 'confirm'`, and `distinct: true` (the
+*   default) goes.
+*
+* A `distinct` that is not a literal and every `ApprovalMode` type reference
+* are follow-ups.
+*/
+function rewriteLiterals017(file, source) {
+	let parsed;
+	try {
+		parsed = parseSync(file, source, {
+			lang: langOf(file),
+			sourceType: "module"
+		});
+	} catch {
+		return {
+			source,
+			changes: [],
+			followUps: []
+		};
+	}
+	if (parsed.errors.length > 0) return {
+		source,
+		changes: [],
+		followUps: []
+	};
+	const lineAt = lineIndex(source);
+	const edits = [];
+	const changes = [];
+	const followUps = [];
+	const text = (node) => source.slice(node.start, node.end);
+	const change = (at, from, to) => {
+		changes.push({
+			...position(lineAt, at),
+			from,
+			to
+		});
+	};
+	const membership = (node, props) => {
+		const keys = new Set(props.map((item) => item.key));
+		if (props.length !== node.properties.length || !keys.has("roles") || !keys.has("tenant") && !keys.has("team") || [...keys].some((key) => !MEMBERSHIP_KEYS.has(key))) return;
+		const tenant = props.find((item) => item.key === "tenant")?.property;
+		const team = props.find((item) => item.key === "team")?.property;
+		if ([tenant, team].some((item) => item?.value.type === "ObjectExpression" || item?.value.type === "ArrayExpression")) return;
+		if (team === void 0 && tenant !== void 0) {
+			const to = `scope: "tenant", id: ${text(tenant.value)}`;
+			edits.push({
+				start: tenant.start,
+				end: tenant.end,
+				text: to
+			});
+			change(tenant.start, text(tenant), to);
+			return;
+		}
+		if (team !== void 0) {
+			const to = `scope: "team", id: ${text(team.value)}`;
+			edits.push({
+				start: team.start,
+				end: team.end,
+				text: to
+			});
+			change(team.start, text(team), to);
+		}
+		if (tenant !== void 0) {
+			const value = text(tenant.value);
+			const to = `within: { ${value === "tenant" ? value : `tenant: ${value}`} }`;
+			edits.push({
+				start: tenant.start,
+				end: tenant.end,
+				text: to
+			});
+			change(tenant.start, text(tenant), to);
+		}
+	};
+	const approval = (props) => {
+		const keys = new Set(props.map((item) => item.key));
+		if (!keys.has("by") && !keys.has("stages")) return;
+		const mode = props.find((item) => item.key === "mode")?.property;
+		const value = mode === void 0 ? void 0 : stringLiteral(mode);
+		if (mode !== void 0 && value !== void 0 && COMBINATORS.has(value)) {
+			edits.push({
+				start: mode.key.start,
+				end: mode.key.end,
+				text: "combine"
+			});
+			change(mode.start, text(mode), `combine: ${text(mode.value)}`);
+		}
+		const distinct = props.find((item) => item.key === "distinct")?.property;
+		if (distinct === void 0) return;
+		const literal = distinct.value;
+		if (literal.type === "Literal" && literal.value === false) {
+			edits.push({
+				start: distinct.start,
+				end: distinct.end,
+				text: "mode: \"confirm\""
+			});
+			change(distinct.start, text(distinct), "mode: \"confirm\"");
+		} else if (literal.type === "Literal" && literal.value === true) {
+			edits.push({
+				...withComma(source, distinct),
+				text: ""
+			});
+			change(distinct.start, text(distinct), "(removed: authorize is the default)");
+		} else followUps.push({
+			...position(lineAt, distinct.start),
+			name: "distinct",
+			message: "distinct is gone since 0.17.0: `mode: \"confirm\"` where it was false; drop it where it was true"
+		});
+	};
+	new Visitor({
+		ObjectExpression(node) {
+			const props = keyed(node);
+			membership(node, props);
+			approval(props);
+		},
+		TSTypeReference(node) {
+			if (node.typeName.type === "Identifier" && node.typeName.name === "ApprovalMode") followUps.push({
+				...position(lineAt, node.start),
+				name: "ApprovalMode",
+				message: "ApprovalMode is `'confirm' | 'authorize'` since 0.17.0; the stage combinator type is ApprovalCombine"
+			});
+		}
+	}).visit(parsed.program);
+	return {
+		source: applyEdits(source, edits),
+		changes,
+		followUps
+	};
+}
+//#endregion
 //#region src/cli/codemod/context.ts
 /** One version's rename map: what the codemod rewrites and what it only reports. */
 const SCRIPT_BLOCK = /<script\b([^>]*)>([\s\S]*?)<\/script>/gu;
@@ -2216,10 +2588,16 @@ const CODEMOD_0_8 = Object.freeze({
 	signatures: SIGNATURE_CHANGES_0_8,
 	configMoves: CONFIG_MOVES_0_8
 });
+const CODEMOD_0_17 = Object.freeze({
+	renames: [],
+	signatures: [],
+	literals: rewriteLiterals017
+});
 /** Each codemod version and the rename map it applies. */
 const CODEMODS = Object.freeze({
 	"0.5": CODEMOD_0_5,
-	"0.8": CODEMOD_0_8
+	"0.8": CODEMOD_0_8,
+	"0.17": CODEMOD_0_17
 });
 function codemodVersions() {
 	return Object.keys(CODEMODS);
@@ -2283,7 +2661,7 @@ function codemod(options) {
 		const source = readFileSync(file, "utf8");
 		if (!source.includes("permdock") && !basename(file).startsWith("permdock.config.")) continue;
 		const name = rel(options.cwd, file);
-		const result = isCodeFile(file) ? withConfigMoves(file, transformSource(file, source, set), set) : cliResult(file, source);
+		const result = isCodeFile(file) ? withConfigMoves(file, withLiterals(file, transformSource(file, source, set), set), set) : cliResult(file, source);
 		if (result.error !== void 0) {
 			followUps.push({
 				file: name,
@@ -2331,6 +2709,15 @@ function codemod(options) {
 		followUps
 	};
 }
+function withLiterals(file, result, set) {
+	if (result.error !== void 0 || set.literals === void 0) return result;
+	const rewritten = set.literals(file, result.source);
+	return {
+		source: rewritten.source,
+		changes: [...result.changes, ...rewritten.changes],
+		followUps: [...result.followUps, ...rewritten.followUps]
+	};
+}
 function withConfigMoves(file, result, set) {
 	if (result.error !== void 0 || set.configMoves === void 0) return result;
 	const moved = moveConfigKeys(file, result.source, set.configMoves);

package/dist/{codemod-B1USJS7a.js → codemod-DqB9klYI.js}

@@ -1,5 +1,5 @@
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { i as dryRunFlag } from "./flags-DXjoTVbS.js";
+import { i as dryRunFlag } from "./flags-BlmpmXoY.js";
 //#region src/cli/commands/codemod.ts
 const codemod = defineLeaf({
 	positionals: [{
@@ -7,7 +7,7 @@ const codemod = defineLeaf({
 		description: "The release to migrate to (0.5)",
 		required: true,
 		async complete() {
-			return (await import("./codemod-ammy6wv4.js")).codemodVersions();
+			return (await import("./codemod-DNGMGqBS.js")).codemodVersions();
 		}
 	}, {
 		name: "paths",
@@ -22,7 +22,7 @@ const codemod = defineLeaf({
 		}
 	},
 	async run(ctx, { flags, args, rest }) {
-		return (await import("./codemod-ammy6wv4.js")).runCodemod({
+		return (await import("./codemod-DNGMGqBS.js")).runCodemod({
 			cwd: ctx.cwd,
 			version: args["version"],
 			paths: rest,

package/dist/{collect-DnXL4B8c.js → collect-C44RrKCI.js}

@@ -1,6 +1,6 @@
-import { n as CliError } from "./errors-Vpu6rKHl.js";
+import { n as CliError } from "./errors-BhRkoNS7.js";
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { o as fileOut, t as checkFlag } from "./flags-DXjoTVbS.js";
+import { o as fileOut, t as checkFlag } from "./flags-BlmpmXoY.js";
 //#region src/cli/commands/collect.ts
 const collect = defineLeaf({
 	flags: {
@@ -29,9 +29,9 @@ const collect = defineLeaf({
 		};
 		if (flags.watch) {
 			if (flags.check) throw new CliError("usage", "collect: --watch writes the catalog; drop --check", { code: "invalid_value" });
-			return (await import("./watch-CuPz0D2M.js")).watchCollect(ctx, overrides);
+			return (await import("./watch-DnymTAfe.js")).watchCollect(ctx, overrides);
 		}
-		const result = await (await import("./collect-D-eroIfV.js")).runCollect({
+		const result = await (await import("./collect-CAibhmCi.js")).runCollect({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			collect: overrides,

package/dist/collect-CAibhmCi.js

@@ -0,0 +1 @@
+export { r as runCollect } from "./collect-HfJXl8Tr.js";

package/dist/{collect-WCl8cJQV.js → collect-HfJXl8Tr.js}

@@ -1,8 +1,8 @@
-import { a as describeError } from "./errors-Vpu6rKHl.js";
+import { a as describeError } from "./errors-BhRkoNS7.js";
 import { a as rel, r as listSourceFiles, s as writeFileEnsuringDir, t as defaultSrcPath } from "./files-BSjrtIHw.js";
-import { n as catalogForCompare, o as formatCatalogJson, r as catalogForDrift, t as buildCatalog } from "./catalog-doc-DjMKzJp9.js";
-import { a as loadModule, i as loadConfiguredPolicy, r as leavesOf, s as pickNamed, t as asPermissionTree } from "./load-DjSU5KXO.js";
-import { t as loadConfiguredOperations } from "./catalog-operations-DeHTrJSV.js";
+import { n as catalogForCompare, o as formatCatalogJson, r as catalogForDrift, t as buildCatalog } from "./catalog-doc-C4DGfJCO.js";
+import { a as loadModule, i as loadConfiguredPolicy, r as leavesOf, s as pickNamed, t as asPermissionTree } from "./load-BaEamml-.js";
+import { t as loadConfiguredOperations } from "./catalog-operations-DVI5QO5R.js";
 import { t as catalogPath } from "./catalog-path-CnI0XTFK.js";
 import { t as shortDiff } from "./text-diff-BtfSmdUo.js";
 import { existsSync, readFileSync } from "node:fs";

package/dist/compile/index.d.ts

@@ -1,3 +1,3 @@
 import { n as GraphSqlPart, r as RelationsMapping, t as GraphSql } from "../graph-sql-BwFC4Qjs.js";
-import { a as CompiledWhere, c as compileWhere, i as CompiledSql, l as escapeLike, n as CompiledCompare, o as MembershipTable, r as CompiledExists, s as MembershipsMapping, t as CompileWhereOptions } from "../compile-BEklRUYo.js";
+import { a as CompiledWhere, c as compileWhere, i as CompiledSql, l as escapeLike, n as CompiledCompare, o as MembershipTable, r as CompiledExists, s as MembershipsMapping, t as CompileWhereOptions } from "../compile-BxiwRotu.js";
 export { type CompileWhereOptions, type CompiledCompare, type CompiledExists, type CompiledSql, type CompiledWhere, type GraphSql, type GraphSqlPart, type MembershipTable, type MembershipsMapping, type RelationsMapping, compileWhere, escapeLike };

package/dist/compile/index.js

@@ -1 +1 @@
-export { n as compileWhere, r as escapeLike } from "../compile-EzEMB-7v.js";
+export { n as compileWhere, r as escapeLike } from "../compile-B_oJqmIg.js";

package/dist/{compile-EzEMB-7v.js → compile-B_oJqmIg.js}

@@ -5,7 +5,7 @@ import { n as PermDockValidationError } from "./validation-error-CYg2kJEw.js";
 import { t as expiredAt } from "./expiry-6XByK0dm.js";
 import { a as expandRelation, c as isEdgeRelation, d as isSelfParented, l as isFieldRelation, o as groupEntries, p as restrictedFor, u as isPrincipalRelation } from "./resource-relations-8-pCScBO.js";
 import { o as epochSeconds, t as INVALID_NOW } from "./time-nR1JesoH.js";
-import { f as scopeList, h as tenantOf, l as rootScope, m as subjectMemberships, s as resolveScope, u as scopeChain } from "./scopes-0Up_UA2t.js";
+import { c as rootScope, d as scopeList, l as scopeChain, p as tenantOf, s as resolveScope } from "./scopes-BSdYaGHs.js";
 import { t as isoInstant } from "./instant-DK3Iz83e.js";
 //#region src/conditions/graph-sql.ts
 /** A Postgres identifier, schema-qualified names split on `.`. */
@@ -460,8 +460,8 @@ function negate(node) {
 		default: throw nonPortable(`unknown compiled node '${String(node)}'`);
 	}
 }
-function matchingMemberships(condition, subject, now, scopes) {
-	const memberships = subjectMemberships(subject?.principal?.memberships, scopes);
+function matchingMemberships(condition, subject, now) {
+	const memberships = subject?.principal?.memberships ?? [];
 	const wanted = new Set(condition.roles);
 	return memberships.filter((membership) => {
 		if (expiredAt(membership, now)) return false;
@@ -549,7 +549,7 @@ function compileMemberOf(condition, options) {
 	if (condition.scope !== "resource" && scope === void 0) return NEVER;
 	const mapping = scope === void 0 ? condition.resource === void 0 ? void 0 : options.memberships?.resource?.[condition.resource] : scopeMembershipTable(options.memberships, scopes, scope);
 	if (mapping !== void 0) return compileExists(condition, mapping, options.subject, Math.ceil(now), options.memberships, scopes);
-	const matched = matchingMemberships(condition, options.subject, now, scopes);
+	const matched = matchingMemberships(condition, options.subject, now);
 	const active = activeTenant(options.subject);
 	if (scope !== void 0) return inList(condition.field, matched.flatMap((membership) => {
 		if (membership.scope !== scope || membership.id === void 0) return [];

package/dist/{compile-BEklRUYo.d.ts → compile-BxiwRotu.d.ts}

@@ -1,6 +1,6 @@
-import { Wt as Instant, br as Condition, hr as Subject, vn as Scope } from "./policy-types-DGIO_gxq.js";
+import { Kt as Instant, bn as Scope, wr as Condition, yr as Subject } from "./policy-types-IRJVABmm.js";
 import { b as ResourceNode } from "./permission-types-CAY-GU7e.js";
-import { f as WhereResult } from "./permdock-CprAPN3w.js";
+import { f as WhereResult } from "./permdock-DUWZEOLR.js";
 import { r as RelationsMapping, t as GraphSql } from "./graph-sql-BwFC4Qjs.js";
 //#region src/conditions/compile.d.ts
 type MembershipTable = {

package/dist/{completion--Y4YItFZ.js → completion-pwVjJlek.js}

@@ -1,6 +1,6 @@
-import { n as CliError } from "./errors-Vpu6rKHl.js";
-import { a as suggestion, o as GLOBAL_FLAGS } from "./args-0FrVs5EH.js";
-import { a as resolve } from "./manifest-Cft51TLK.js";
+import { n as CliError } from "./errors-BhRkoNS7.js";
+import { a as GLOBAL_FLAGS, i as suggestion } from "./args-iafbHiXn.js";
+import { a as resolve } from "./manifest-Dij1U0hx.js";
 import { t as defineLeaf } from "./command-L8EstFNm.js";
 //#region src/cli/core/completion.ts
 const SHELLS = [

package/dist/{config-CcLlvEYW.js → config-COHmivz9.js}

@@ -1,6 +1,6 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
-import { i as configError, n as CliError } from "./errors-Vpu6rKHl.js";
-import { n as betterSupabaseDefaults, t as betterSupabaseConfig } from "./better-supabase-Dirf_8Ec.js";
+import { i as configError, n as CliError } from "./errors-BhRkoNS7.js";
+import { n as betterSupabaseConfig, r as betterSupabaseDefaults } from "./better-supabase-BJtQ-kNf.js";
 import { a as isSection, i as isModuleKey, n as MODULE_KEYS, o as kindOf, r as describeKinds, t as CONFIG_SHAPE } from "./config-shape-tsxHx71E.js";
 import { existsSync } from "node:fs";
 import { relative, resolve } from "node:path";
@@ -77,7 +77,7 @@ async function readConfig(cwd, fromFlag, options) {
 		file: void 0
 	};
 	if (!existsSync(path)) throw new CliError("usage", `PermDock CLI: config file not found: ${path}`, { code: "config_not_found" });
-	const { loadModule, pickNamed } = await import("./load-Dm0pSYH3.js");
+	const { loadModule, pickNamed } = await import("./load-CjnlPxpL.js");
 	const mod = await loadModule(path, options);
 	const display = relative(cwd, path).replaceAll("\\", "/");
 	const raw = pickNamed(mod, ["default"]);
@@ -92,7 +92,7 @@ function hasModuleValue(raw) {
 	return isRecord(raw) && Object.keys(MODULE_KEYS).some((key) => isRecord(raw[key]));
 }
 async function traceValues(cwd, file, display, config, options) {
-	const { traceModuleValues } = await import("./module-values-B1EVTkHP.js");
+	const { traceModuleValues } = await import("./module-values-B8tNIxdd.js");
 	return traceModuleValues({
 		cwd,
 		file,

package/dist/{config-BQ77xMZk.js → config-DnfH6_eT.js}

@@ -1,5 +1,5 @@
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { a as failOnFlag } from "./flags-DXjoTVbS.js";
+import { a as failOnFlag } from "./flags-BlmpmXoY.js";
 //#region src/cli/commands/config.ts
 const config = defineLeaf({
 	flags: {
@@ -10,7 +10,7 @@ const config = defineLeaf({
 		...failOnFlag
 	},
 	async run(ctx, { flags }) {
-		const { runConfig } = await import("./config-report-DVMOLJ7F.js");
+		const { runConfig } = await import("./config-report-C1jl7Na-.js");
 		return runConfig({
 			cwd: ctx.cwd,
 			config: ctx.config,

package/dist/{config-report-DVMOLJ7F.js → config-report-C1jl7Na-.js}

@@ -1,9 +1,9 @@
 import { a as rel, t as defaultSrcPath } from "./files-BSjrtIHw.js";
 import { r as CONFIG_REPORT_SCHEMA } from "./version-DMQ0dnN5.js";
 import { t as catalogPath } from "./catalog-path-CnI0XTFK.js";
-import { n as guessPermissions, t as barrelFile } from "./collect-WCl8cJQV.js";
+import { n as guessPermissions, t as barrelFile } from "./collect-HfJXl8Tr.js";
 import "./sources-C4vkzZJV.js";
-import { t as DOCS_BASE } from "./manifest-Cft51TLK.js";
+import { t as DOCS_BASE } from "./manifest-Dij1U0hx.js";
 import { n as MIGRATION_DIRS, t as DEFAULT_SENSITIVE_ACTIONS } from "./constants-DcJABbLW.js";
 //#region src/cli/config-report.ts
 function configReport(input) {

package/dist/{context-BnIzxTNE.js → context-DeammvFl.js}

@@ -1,6 +1,6 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { a as isPromiseLike } from "./store-options-Dil3lraY.js";
-import { n as switchTenant, t as providerStore } from "./provider-store-CaTv00tr.js";
+import { l as isPromiseLike } from "./store-options--zWn48PK.js";
+import { n as switchTenant, t as providerStore } from "./provider-store-BQP_pp8s.js";
 import { getContext, onDestroy, setContext } from "svelte";
 import { toStore } from "svelte/store";
 //#region src/svelte/context.ts

package/dist/convex/index.d.ts

@@ -1,8 +1,8 @@
-import { T as Policy, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
+import { E as Policy, M as PolicyVocabulary, _r as Principal } from "../policy-types-IRJVABmm.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { a as PermDock } from "../permdock-CprAPN3w.js";
-import { a as ProblemDetails, r as PermDockDeniedError } from "../errors-BIM4MFsJ.js";
-import { t as InstanceOptions } from "../instance-options-CoHn-0e8.js";
+import { a as PermDock } from "../permdock-DUWZEOLR.js";
+import { a as ProblemDetails, r as PermDockDeniedError } from "../errors-Dc9FdamT.js";
+import { t as InstanceOptions } from "../instance-options-BOCRxEFb.js";
 //#region src/convex/types.d.ts
 type ConvexContextLike = {
   readonly auth?: {

package/dist/convex/index.js

@@ -1,9 +1,9 @@
 import { t as compact } from "../compact-CAf557ZB.js";
 import { n as PermDockValidationError } from "../validation-error-CYg2kJEw.js";
 import { n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "../errors-B6R_lg2a.js";
-import { l as withApp } from "../permdock-BvjivVb9.js";
-import { n as resolveOrNull, t as buildInstance } from "../build-instance-BWXqwQYU.js";
-import { n as tenantScope, t as actorFrom } from "../adapter-context-CIQpQxbE.js";
+import { l as withApp } from "../permdock-DdzMv5-F.js";
+import { n as resolveOrNull, t as buildInstance } from "../build-instance-lye7oEqf.js";
+import { n as tenantScope, t as actorFrom } from "../adapter-context-OHikyRqV.js";
 //#region src/convex/create.ts
 /**
 * Convex's runtime sends `data` to the client only for an error carrying this