permdock 0.17.0 → 0.18.0

package/dist/react-native/index.js

@@ -2,7 +2,7 @@
 import { r as isRecord, t as compact } from "../compact-CAf557ZB.js";
 import { n as freezeDeep } from "../freeze-jjan0lCv.js";
 import { r as requiredPlans } from "../problem-details-CLDgX1KV.js";
-import { n as describe } from "../describe-CogP1loh.js";
+import { n as describe } from "../describe-BZAlPHxT.js";
 import { n as isThenable } from "../thenable-BNSM1U2R.js";
 import { h as secondsAt, m as rfc3339 } from "../time-nR1JesoH.js";
 import { d as scopeList, o as normalizeMemberships, p as tenantOf$1, s as resolveScope } from "../scopes-BSdYaGHs.js";
@@ -11,11 +11,12 @@ import { t as byCodePoint } from "../compare-DTfyUunF.js";
 import { d as resolveActiveTenant, r as isMembershipExpired } from "../tenancy-DvOHHk3-.js";
 import { a as bindConditionRefs, n as parseSnapshot } from "../snapshot-DN_8J27z.js";
 import { r as heldRoleNames, t as emptySnapshot } from "../from-snapshot-DMlSSo9b.js";
-import { t as parseLocalSnapshotManifest } from "../parse-local-manifest-DEiCF4ah.js";
-import { r as approvalHeaders } from "../protected-action-B6n6w7Rl.js";
+import { t as parseLocalSnapshotManifest } from "../parse-local-manifest-CxcSMQgl.js";
+import { r as approvalHeaders } from "../protected-action-OpOxtTsN.js";
 import { a as eventSourceRefresh, c as isJws, n as storeOf, r as authzChangeRefresh, t as adapterStore } from "../store-options--zWn48PK.js";
 import { a as PermDockUiContext, i as PermDockStoreContext, n as useKeyed, t as useLiveOptions } from "../live-options-BBIT68le.js";
-import { a as useAssignableRoles, c as useGate, d as usePermission, f as usePermissions, g as useTenant, h as useSubject, i as useAssignablePermissions, l as useMemberships, m as useRoles, n as Protected, o as useDescribe, r as useApproval, s as useFilter, t as useProtectedAction, u as usePermDock } from "../protected-action-qowj6nxN.js";
+import { a as useAssignableRoles, c as useGate, d as usePermission, f as usePermissions, g as useTenant, h as useSubject, i as useAssignablePermissions, l as useMemberships, m as useRoles, n as Protected, o as useDescribe, r as useApproval, s as useFilter, t as useProtectedAction, u as usePermDock } from "../protected-action-B40tU3yP.js";
+import { r as authzUserTopic, t as AUTHZ_EVENT } from "../authz-topic-Dbc-HDOS.js";
 import { useEffect, useMemo, useRef } from "react";
 import { jsx } from "react/jsx-runtime";
 //#region src/react-native/guards.ts
@@ -316,7 +317,8 @@ function buildLocalSnapshot(manifest, data, at) {
 			customRoles: tenantCustom
 		})],
 		scopes: manifest.scopes,
-		vocabulary: manifest.vocabulary
+		vocabulary: manifest.vocabulary,
+		authzVersion: Number.isSafeInteger(data.authzVersion) && (data.authzVersion ?? -1) >= 0 ? data.authzVersion : void 0
 	}));
 }
 /**
@@ -334,6 +336,7 @@ function localSnapshot(options) {
 function isColumns(roles) {
 	return Array.isArray(roles);
 }
+/** A SQLite identifier in double quotes. */
 function quoted(name) {
 	return `"${name.replaceAll("\"", "\"\"")}"`;
 }
@@ -359,6 +362,7 @@ function rowTables(rows) {
 		tables.add(rows.customRoles.permissions);
 		tables.add(rows.customRoles.includes);
 	}
+	if (rows.version !== void 0) tables.add(rows.version.table);
 	return [...tables];
 }
 function rowQuery(table) {
@@ -495,8 +499,21 @@ function customRolesOf(permissions, includes) {
 	return [...roles.values()].map(customRoleOf);
 }
 /**
-* The user's memberships, global roles and custom roles from the rows of the
-* tables `rows` names.
+* The highest version on the user's rows of the version table. SQLite returns a
+* `bigint` column as a number, or as text past 2^53.
+*/
+function versionOf(table, tables, user) {
+	if (table === void 0) return;
+	let found;
+	for (const row of rowsOf(tables, table.table)) {
+		const value = Number(text(row[table.version]));
+		if (text(row[table.user]) === user && Number.isSafeInteger(value) && value >= 0 && (found === void 0 || value > found)) found = value;
+	}
+	return found;
+}
+/**
+* The user's memberships, global roles, custom roles and authorization version
+* from the rows of the tables `rows` names.
 */
 function readRows(rows, tables, principal) {
 	const { id: user, tenant, attributes } = principal;
@@ -507,7 +524,9 @@ function readRows(rows, tables, principal) {
 		return key === void 0 ? [] : [key];
 	}) : []);
 	const custom = rows.customRoles;
+	const authzVersion = versionOf(rows.version, tables, user);
 	return {
+		...authzVersion === void 0 ? {} : { authzVersion },
 		principal: {
 			id: user,
 			roles: [...new Set(roles)].toSorted(),
@@ -649,6 +668,173 @@ function powerSyncSourceCache(db) {
 	} });
 }
 //#endregion
+//#region src/react-native/subscriptions.ts
+/**
+* `subscribeForeground` over `AppState`: `active` returns to the foreground and
+* `background` leaves it. iOS `inactive` (a system sheet over the app) is
+* neither.
+*/
+function appStateForeground(appState) {
+	return (listener) => {
+		const subscription = appState.addEventListener("change", (state) => {
+			if (state === "active") listener(true);
+			else if (state === "background") listener(false);
+		});
+		return () => {
+			subscription.remove();
+		};
+	};
+}
+/**
+* `subscribeOnline` over NetInfo. An unknown (`null`) connection counts as
+* online.
+*/
+function netInfoOnline(netInfo) {
+	return (listener) => netInfo.addEventListener((state) => {
+		listener(state.isConnected !== false && state.isInternetReachable !== false);
+	});
+}
+//#endregion
+//#region src/react-native/native-refresh.ts
+/** The `authz_ver` claim of an access token, read without verifying it. */
+function tokenVersion(token) {
+	const payload = token.split(".")[1];
+	if (payload === void 0) return;
+	try {
+		const base64 = payload.replaceAll("-", "+").replaceAll("_", "/");
+		const claims = JSON.parse(atob(base64.padEnd(Math.ceil(base64.length / 4) * 4, "=")));
+		const version = isRecord(claims) ? claims["authz_ver"] : void 0;
+		return typeof version === "number" && Number.isSafeInteger(version) && version >= 0 ? version : void 0;
+	} catch {
+		return;
+	}
+}
+function highest(rows) {
+	let found;
+	for (const row of rows) {
+		const value = Number(isRecord(row) ? row["version"] : void 0);
+		if (Number.isSafeInteger(value) && value >= 0 && (found === void 0 || value > found)) found = value;
+	}
+	return found;
+}
+async function currentSession(supabase) {
+	try {
+		return (await supabase.auth.getSession()).data.session;
+	} catch {
+		return null;
+	}
+}
+/**
+* A `refreshOn` trigger for an Expo app on Supabase: on each message on the
+* user's private `authz:<uid>` topic it refreshes the Supabase session, then
+* reconnects PowerSync so streams that read token claims see the new ones, then
+* refreshes the snapshot. Passes run one at a time; signals during a pass fold
+* into one more. The channel closes in the background and rejoins on
+* foreground, where one catch-up pass runs: a version check with
+* `powersync.manifest`, else a full pass. It never imports `@supabase/*` or
+* `@powersync/*`.
+*/
+function nativeRefresh(options) {
+	const { supabase, powersync } = options;
+	const versionRows = powersync?.manifest?.rows?.version;
+	return (refresh) => {
+		let closed = false;
+		let online = true;
+		let held = false;
+		let running = false;
+		let again = false;
+		let channel;
+		let joins = 0;
+		let watching;
+		const pass = async () => {
+			try {
+				await supabase.auth.refreshSession();
+				if (powersync !== void 0) {
+					await powersync.db.disconnect();
+					await powersync.db.connect(powersync.connector);
+				}
+			} catch {}
+			if (!closed) refresh();
+		};
+		const signal = () => {
+			if (closed) return;
+			if (!online) {
+				held = true;
+				return;
+			}
+			if (running) {
+				again = true;
+				return;
+			}
+			running = true;
+			pass().finally(() => {
+				running = false;
+				if (again) {
+					again = false;
+					signal();
+				}
+			});
+		};
+		const versionSql = versionRows === void 0 ? void 0 : `SELECT ${quoted(versionRows.version)} AS version FROM ${quoted(versionRows.table)} WHERE ${quoted(versionRows.user)} = ?`;
+		const checkVersion = async () => {
+			if (versionSql === void 0 || powersync === void 0) return;
+			const current = await currentSession(supabase);
+			if (current === null || closed) return;
+			const token = tokenVersion(current.access_token);
+			try {
+				const synced = highest(await powersync.db.getAll(versionSql, [current.user.id]));
+				if (token !== void 0 && synced !== void 0 && synced > token) signal();
+			} catch {}
+		};
+		const leave = () => {
+			joins += 1;
+			if (channel !== void 0) {
+				supabase.removeChannel(channel);
+				channel = void 0;
+			}
+		};
+		const join = async () => {
+			joins += 1;
+			const generation = joins;
+			const current = await currentSession(supabase);
+			if (closed || generation !== joins || current === null) return;
+			channel = supabase.channel(authzUserTopic(current.user.id), { config: { private: true } });
+			channel.on("broadcast", { event: AUTHZ_EVENT }, () => {
+				signal();
+			});
+			channel.subscribe();
+			if (versionSql !== void 0 && powersync !== void 0 && watching === void 0) {
+				watching = new AbortController();
+				powersync.db.watch(versionSql, [current.user.id], { onResult: () => {
+					checkVersion();
+				} }, { signal: watching.signal });
+			}
+		};
+		join();
+		const offForeground = appStateForeground(options.appState)((active) => {
+			leave();
+			if (active === false) return;
+			join();
+			if (versionSql === void 0) signal();
+			else checkVersion();
+		});
+		const offOnline = options.netInfo === void 0 ? void 0 : netInfoOnline(options.netInfo)((next) => {
+			online = next;
+			if (next && held) {
+				held = false;
+				signal();
+			}
+		});
+		return () => {
+			closed = true;
+			leave();
+			offForeground();
+			offOnline?.();
+			watching?.abort();
+		};
+	};
+}
+//#endregion
 //#region src/react-native/storage.ts
 const SNAPSHOT_KEY = "permdock.snapshot";
 const TENANT_KEY = "permdock.tenant";
@@ -1099,31 +1285,4 @@ function mmkvStorage(mmkv) {
 	};
 }
 //#endregion
-//#region src/react-native/subscriptions.ts
-/**
-* `subscribeForeground` over `AppState`: `active` returns to the foreground and
-* `background` leaves it. iOS `inactive` (a system sheet over the app) is
-* neither.
-*/
-function appStateForeground(appState) {
-	return (listener) => {
-		const subscription = appState.addEventListener("change", (state) => {
-			if (state === "active") listener(true);
-			else if (state === "background") listener(false);
-		});
-		return () => {
-			subscription.remove();
-		};
-	};
-}
-/**
-* `subscribeOnline` over NetInfo. An unknown (`null`) connection counts as
-* online.
-*/
-function netInfoOnline(netInfo) {
-	return (listener) => netInfo.addEventListener((state) => {
-		listener(state.isConnected !== false && state.isInternetReachable !== false);
-	});
-}
-//#endregion
-export { PermDockProvider, Protected, appStateForeground, approvalHeaders, authzChangeRefresh, buildLocalSnapshot, connectSource, describe, eventSourceRefresh, localSnapshot, memorySnapshotStorage, mmkvStorage, nativeStore, netInfoOnline, parseLocalSnapshotManifest, powerSyncSource, powerSyncSourceCache, requiredPlans, secureStoreStorage, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissionGuard, usePermissions, useProtectedAction, useRoles, useSnapshotReady, useSubject, useTenant };
+export { PermDockProvider, Protected, appStateForeground, approvalHeaders, authzChangeRefresh, buildLocalSnapshot, connectSource, describe, eventSourceRefresh, localSnapshot, memorySnapshotStorage, mmkvStorage, nativeRefresh, nativeStore, netInfoOnline, parseLocalSnapshotManifest, powerSyncSource, powerSyncSourceCache, requiredPlans, secureStoreStorage, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissionGuard, usePermissions, useProtectedAction, useRoles, useSnapshotReady, useSubject, useTenant };

package/dist/{replay-Dc3d8LhG.d.ts → replay-E5X9E1lC.d.ts}

@@ -1,4 +1,4 @@
-import { l as ReplayStore } from "./types-CJC1aaoJ.js";
+import { l as ReplayStore } from "./types-Ck1KOfug.js";
 //#region src/ssf/replay.d.ts
 declare function memoryReplayStore(): ReplayStore;
 //#endregion

package/dist/{request-context-Ch052blg.js → request-context-DM6_jY1n.js}

@@ -1,6 +1,6 @@
 import { t as assertAppData } from "./app-data-UNNm07jV.js";
 import { n as wrapPermDock } from "./wrap-C5PWzgkq.js";
-import { t as buildInstance } from "./build-instance-lye7oEqf.js";
+import { t as buildInstance } from "./build-instance-BFMFQdE_.js";
 //#region src/core/request-context.ts
 /**
 * Errors an adapter raises around one instance (a `context` hook that threw, an

package/dist/resend/index.d.ts

@@ -1,7 +1,7 @@
-import { Y as DecisionSink } from "../policy-types-IRJVABmm.js";
-import { n as ApprovalUrl, t as ApprovalPrompt } from "../approval-prompt-BSh-yxbH.js";
-import { d as EmailTransport, o as DeliveryResult, u as EmailMessage } from "../types-UfpcY575.js";
-import { l as ReplayStore } from "../types-CJC1aaoJ.js";
+import { Y as DecisionSink } from "../policy-types-D-GwfQTc.js";
+import { n as ApprovalUrl, t as ApprovalPrompt } from "../approval-prompt-Bg7gDSqd.js";
+import { d as EmailTransport, o as DeliveryResult, u as EmailMessage } from "../types-CCEeSCMB.js";
+import { l as ReplayStore } from "../types-Ck1KOfug.js";
 //#region src/resend/approval-email.d.ts
 type ApprovalEmailOptions = {
   /**

package/dist/{resolve-names-1nCei24V.js → resolve-names-CBl4r4_r.js}

@@ -5,7 +5,7 @@ import { i as configError } from "./errors-BhRkoNS7.js";
 import "./budget-BBCPDOGP.js";
 import "./sources-C4vkzZJV.js";
 import { A as quoteQualified, D as qualified, I as scopeTypeOf, O as quoteIdent } from "./shared-DyYVEjKC.js";
-import { F as globalRoleRows, Q as graphSqlName, Z as graphHelper, _ as PERMISSION_HELPERS, at as memberForHelper, c as holderSources, ct as memberIdsHelper, dt as permittedForHelper, ft as permittedIdsHelper, ht as scopeTable, lt as memberOfHelper, nt as inheritedRowsHelper, o as graphPlan, pt as restrictedHelper, r as tableNames, rt as isTeamScope, tt as hasPermittedUsers, v as checkName, x as permittedByPermissionHelper } from "./tables-BsGE6HBR.js";
+import { F as globalRoleRows, Q as graphSqlName, Z as graphHelper, _ as PERMISSION_HELPERS, at as memberForHelper, c as holderSources, ct as memberIdsHelper, dt as permittedForHelper, ft as permittedIdsHelper, ht as scopeTable, lt as memberOfHelper, nt as inheritedRowsHelper, o as graphPlan, pt as restrictedHelper, r as tableNames, rt as isTeamScope, tt as hasPermittedUsers, v as checkName, x as permittedByPermissionHelper } from "./tables-BfOk0ymL.js";
 import { t as FIELD_VIEWS } from "./fields-CrjL6A49.js";
 //#region src/cli/rls/permission-holders.ts
 /**

package/dist/{rls-ClJRblnR.js → rls-DGBL-jDY.js}

@@ -8,25 +8,25 @@ import { o as sqlFiles } from "./files-BSjrtIHw.js";
 import { c as requirePolicy } from "./load-BaEamml-.js";
 import { i as qualifySqlTable, r as escapeSqlIdent } from "./sql-0WjxIp9g.js";
 import "./sources-C4vkzZJV.js";
-import { t as policyFromCatalog } from "./policy-from-catalog-DVa1faOr.js";
+import { t as policyFromCatalog } from "./policy-from-catalog-B68hGC0S.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
 import { i as INDEXES_MARKER, n as GRANTS_MARKER, o as SEEDS_MARKER, t as BACKFILL_MARKER } from "./markers-BeHZ4x9Q.js";
-import { a as nonEmptyOr } from "./output-DhTpe8v1.js";
+import { a as nonEmptyOr } from "./output-BFWLER4r.js";
 import { i as requirePeer, n as packageManagerOf, t as addLine } from "./peer-BuK9F53f.js";
 import { t as POLICY_NOT_PUBLISHED } from "./problem-types-DSsRfONQ.js";
-import { t as fetchProjectPolicy } from "./pull-DVoZ0V9_.js";
+import { t as fetchProjectPolicy } from "./pull-DLP4I1Kl.js";
 import { n as MIGRATION_DIRS } from "./constants-DcJABbLW.js";
 import { a as isSeedsDirectory, c as parseSplit, d as seedsMigration, f as writeOutputFiles, l as partPath, n as dataMigrationFile, r as driftOf, u as pgDeltaPath } from "./output-files-CM0BnH05.js";
-import { b as rbacScaffold, d as resolveSchemas, f as schemasRefusal, o as supabaseHookSql, p as declarativeSql, s as approvalsSql, t as grantsLabel, u as isSupabaseSchemas, y as parseRbacAuthorize } from "./supabase-hook-Cj85nccs.js";
+import { b as rbacScaffold, d as resolveSchemas, f as schemasRefusal, o as supabaseHookSql, p as declarativeSql, s as approvalsSql, t as grantsLabel, u as isSupabaseSchemas, y as parseRbacAuthorize } from "./supabase-hook-DX38Hj8h.js";
 import { A as quoteQualified, D as qualified$1, I as scopeTypeOf, O as quoteIdent$1, _ as subjectClaimJsonSql, c as SESSION_LIVE_HELPER, g as sessionLiveHelperSql, j as quoteTable, k as quoteLiteral, r as HELPERS, t as CUSTOM_ROLES, y as subjectIdSql } from "./shared-DyYVEjKC.js";
-import { C as accessSql, G as byKey, T as seedSql, Z as graphHelper, ct as memberIdsHelper, ft as permittedIdsHelper, ht as scopeTable, mt as scopeSources, r as tableNames, s as graphSql, w as helpersSql, x as permittedByPermissionHelper, y as permissionHelpersSql } from "./tables-BsGE6HBR.js";
-import { c as breakGlassKey, i as assignmentSql, l as collectGrants, n as ownershipSql, s as breakGlassHolder } from "./ownership-moSRhxl_.js";
+import { C as accessSql, G as byKey, T as seedSql, Z as graphHelper, ct as memberIdsHelper, ft as permittedIdsHelper, ht as scopeTable, mt as scopeSources, r as tableNames, s as graphSql, w as helpersSql, x as permittedByPermissionHelper, y as permissionHelpersSql } from "./tables-BfOk0ymL.js";
+import { c as breakGlassKey, i as assignmentSql, l as collectGrants, n as ownershipSql, s as breakGlassHolder } from "./ownership-D-mIt-w0.js";
 import { a as splitUndiffed } from "./deciding-columns-NB4wcyBf.js";
 import { t as connectPgPool } from "./pg-Ddxsd5ZB.js";
 import { a as fieldViewsSql, c as ACTOR_MAY_WRITE, f as readOnlyActorKinds, i as fieldViews, l as actorMayWriteSql, n as columnGrantSql, o as rowBranches, p as readOnlyActorPolicies, r as columnRevokeSql, u as assemblePolicies } from "./fields-CrjL6A49.js";
-import { n as permissionHoldersSql } from "./resolve-names-1nCei24V.js";
-import { _ as indexTargets, a as verifyResult, b as readTableIndexFacts, c as callsHelper, g as INDEX_COLUMNS_SQL, h as COLUMNS_SQL, i as verifyIgnores, l as helperCallKeys, m as tableFor, n as runRlsVerify, o as HELPER_TABLES, p as compileGrants, r as rlsFinding, v as indexesSql, y as pruneIndexTargets } from "./verify-C8G8D5mk.js";
-import { a as buildContext, c as levelKeys, d as rebuildPlan, i as splitsPart, l as rowHelpersSql, n as generateOptions, o as CANDIDATES, r as isRefusal, s as inheritTargets, t as supautilsRejections, u as DROPPED_LIST } from "./supautils-BP_5WAIc.js";
+import { n as permissionHoldersSql } from "./resolve-names-CBl4r4_r.js";
+import { _ as indexTargets, a as verifyResult, b as readTableIndexFacts, c as callsHelper, g as INDEX_COLUMNS_SQL, h as COLUMNS_SQL, i as verifyIgnores, l as helperCallKeys, m as tableFor, n as runRlsVerify, o as HELPER_TABLES, p as compileGrants, r as rlsFinding, v as indexesSql, y as pruneIndexTargets } from "./verify-Bpj0hauG.js";
+import { a as buildContext, c as levelKeys, d as rebuildPlan, i as splitsPart, l as rowHelpersSql, n as generateOptions, o as CANDIDATES, r as isRefusal, s as inheritTargets, t as supautilsRejections, u as DROPPED_LIST } from "./supautils-BGf6zRvM.js";
 import { readFileSync } from "node:fs";
 import { basename, delimiter, join } from "node:path";
 import { spawn } from "node:child_process";
@@ -1601,7 +1601,7 @@ function generateSql(input, policy, options, built, warnings) {
 	const checked = preflight(input, built);
 	if (isRefusal(checked)) return checked;
 	const { jsonSchema } = checked;
-	if (jsonSchema !== void 0 && jsonSchema !== false && (rls?.approvals === void 0 || rls.approvals === false)) warnings.push("rls.jsonSchema constrains the approval store's body, which needs rls.approvals: true; nothing else is jsonb");
+	if (jsonSchema !== void 0 && jsonSchema !== false && (rls?.approvals === void 0 || rls.approvals === false || typeof rls.approvals === "object" && rls.approvals.store === false)) warnings.push("rls.jsonSchema constrains the approval store's body, which needs rls.approvals: true; nothing else is jsonb");
 	const generated = generatePolicies(input, policy, options, built, warnings);
 	if (isRefusal(generated)) return generated;
 	const assembled = preambleSql(input, policy, options, built, generated, jsonSchema, warnings);

package/dist/{rls-BVzoZCn3.js → rls-pAHGYgTb.js}

@@ -192,7 +192,7 @@ async function rlsInput(ctx, verb, shape, options) {
 	};
 }
 async function runRls(input) {
-	return (await import("./rls-ClJRblnR.js")).runRls(input);
+	return (await import("./rls-DGBL-jDY.js")).runRls(input);
 }
 const generate = defineLeaf({
 	flags: {

package/dist/{role-builder-BrmOcXch.js → role-builder-CMW4wWzn.js}

@@ -6,7 +6,7 @@ import { c as listPermissions, o as isPermission } from "./permission-registry-B
 import { n as assertMetaValue, r as parseAppData, t as assertAppData } from "./app-data-UNNm07jV.js";
 import { a as durationOf, r as assertDuration } from "./time-nR1JesoH.js";
 import { d as roleScopeOf, g as isRole, o as flattenGrantee, r as asGrantee, u as roleNameOf } from "./grantee-Dke-9rd1.js";
-import { a as normalizeApproval, t as activationApproval } from "./approval-normalize-4KxMRdJC.js";
+import { a as normalizeApproval, t as activationApproval } from "./approval-normalize-CUjgSsOl.js";
 import { c as sanitizeFields, n as normalizeValidity } from "./validity-Buc7w8E9.js";
 //#region src/conditions/opaque.ts
 function opaque(input) {

package/dist/{rpc-BOu3FD6X.js → rpc-KwX_Jcxz.js}

@@ -1,7 +1,7 @@
 import { t as compact } from "./compact-CAf557ZB.js";
 import { s as requestFromContext } from "./http-DKLXrFGk.js";
 import { n as tenantScope } from "./adapter-context-OHikyRqV.js";
-import { t as adapterKernel } from "./bind-BJFeLX1V.js";
+import { t as adapterKernel } from "./bind-B4pMH9bm.js";
 import { r as guardIterable } from "./stream-CDvF0sJm.js";
 //#region src/server/rpc.ts
 /** The tRPC and oRPC error code for a Problem Details status. */

package/dist/{run-CnCaTjWX.js → run-B7lv3NuK.js}

@@ -5,9 +5,9 @@ import { a as resolveCwd, i as readConfig } from "./config-COHmivz9.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
 import { a as GLOBAL_FLAGS, i as suggestion, n as parseFlags, r as parseLeaf } from "./args-iafbHiXn.js";
 import { r as progressReporter, t as redact } from "./credentials-dkycUsY3.js";
-import { a as resolve, i as leaves, n as ROOT, r as SECTIONS, t as DOCS_BASE } from "./manifest-Dij1U0hx.js";
+import { a as resolve, i as leaves, n as ROOT, r as SECTIONS, t as DOCS_BASE } from "./manifest-wclLWBVH.js";
 import { t as createStyle } from "./style-Ds11Hmk4.js";
-import { i as githubAnnotations, n as envelope, o as sarifLog, t as dataOf } from "./output-DhTpe8v1.js";
+import { i as githubAnnotations, n as envelope, o as sarifLog, t as dataOf } from "./output-BFWLER4r.js";
 import { stripVTControlCharacters } from "node:util";
 import { existsSync, statSync } from "node:fs";
 import { createHash } from "node:crypto";

package/dist/run-UPbacxPg.js

@@ -0,0 +1 @@
+export { t as run } from "./run-B7lv3NuK.js";

package/dist/{run-ticket-C6lXvHM_.d.ts → run-ticket-DPaD27_r.d.ts}

@@ -1,5 +1,5 @@
-import { Kt as Instant, _r as Principal, _t as TokenVerifier, an as AuthEvent, gt as TokenSigner, ht as TokenFailureCause, lr as AuthorizationDetail, pr as Delegation, sr as Actor, yr as Subject } from "./policy-types-IRJVABmm.js";
-import { _ as PrincipalSource } from "./permdock-DUWZEOLR.js";
+import { Kt as Instant, _r as Principal, _t as TokenVerifier, an as AuthEvent, gt as TokenSigner, ht as TokenFailureCause, lr as AuthorizationDetail, pr as Delegation, sr as Actor, yr as Subject } from "./policy-types-D-GwfQTc.js";
+import { _ as PrincipalSource } from "./permdock-ffY4CMd9.js";
 //#region src/server/run-ticket.d.ts
 /**
  * What started the run: a saved automation, a background job, or a caller's own

package/dist/{runtime-CBXkOcg9.js → runtime-rf0ZuyF3.js}

@@ -1,4 +1,4 @@
-import { l as scopedTenant, s as protectedView } from "./views-TrZYlDnM.js";
+import { l as scopedTenant, s as protectedView } from "./views-MWmJ6Y4P.js";
 //#region src/svelte/protected.ts
 /**
 * The instance for `tenant`, built once per store change rather than once per

package/dist/{saas-BqM9mJkk.js → saas-B8H1MsQ3.js}

@@ -1,12 +1,12 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
 import { i as principal } from "./refs-C8BKxc_e.js";
-import { a as deny, n as role, r as allow } from "./role-builder-BrmOcXch.js";
-import { C as limits, M as memoryCustomRoleSource, S as memoryRelationSource, w as memoryLimitStore } from "./src-nYNBfmgq.js";
+import { a as deny, n as role, r as allow } from "./role-builder-CMW4wWzn.js";
+import { A as memoryCustomRoleSource, C as limits, S as memoryRelationSource, w as memoryLimitStore } from "./src-Brzq_0in.js";
 import { h as secondsAt } from "./time-nR1JesoH.js";
 import { l as relation, n as anyone } from "./grantee-Dke-9rd1.js";
-import { r as definePolicy } from "./policy-DxQyHKPB.js";
+import { r as definePolicy } from "./policy-cV_wwPb8.js";
 import { s as quoteSqlLiteral } from "./sql-0WjxIp9g.js";
-import { a as saasPlans, i as saasPermissions, o as saasRoles } from "./permissions-CvpPtz5O.js";
+import { a as saasPlans, i as saasPermissions, o as saasRoles } from "./permissions-B3ggI88M.js";
 //#region src/testing/saas/policy.ts
 function isSubject(user) {
 	return user !== null && "context" in user && "principal" in user;

package/dist/{scan-CepUXrFt.js → scan-0r3OZqqK.js}

@@ -16,7 +16,7 @@ const scan = defineLeaf({
 		}
 	},
 	async run(ctx, { flags }) {
-		const { runAdoptionScan } = await import("./adoption-scan-Ci0xiJ3T.js");
+		const { runAdoptionScan } = await import("./adoption-scan-CxExBYSJ.js");
 		return runAdoptionScan({
 			cwd: ctx.cwd,
 			srcPath: flags.src.length > 0 ? flags.src : ctx.config.collect?.srcPath ?? ["src"],

package/dist/{schema-9_NDz8fx.js → schema-B_9tXrbG.js}

@@ -1,7 +1,7 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
 import { l as packageRoot } from "./version-DMQ0dnN5.js";
 import { t as DRAFT_PINS } from "./pins-nqarl3oE.js";
-import { a as nonEmptyOr } from "./output-DhTpe8v1.js";
+import { a as nonEmptyOr } from "./output-BFWLER4r.js";
 import { t as require__2020 } from "./2020-CJbO8Bvz.js";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";

package/dist/scim/index.d.ts

@@ -1,3 +1,3 @@
 import { t as SqlQuery } from "../sql-B80DFdpG.js";
-import { A as ScimFilter, C as DirectoryUser, D as PATCH_SCHEMA, E as LIST_SCHEMA, F as ScimTokenOptions, I as USER_SCHEMA, L as isDirectoryNotFoundError, M as ScimPage, N as ScimPageResult, O as ROLES_EXTENSION, P as ScimPatchOp, R as isDirectoryUniquenessError, S as DirectoryUniquenessError, T as GROUP_SCHEMA, _ as DirectoryChange, a as normalizePatchOps, b as DirectoryNotFoundError, c as filterSupported, d as resourceTypes, f as schemas, g as APP_DATA_EXTENSION, h as sha256Hex, i as directoryMembershipSource, j as ScimHandlerOptions, k as SCIM_CONTENT_TYPE, l as matchFilter, m as authenticateScim, n as postgresDirectoryStore, o as tenantFromPath, p as serviceProviderConfig, r as memoryDirectoryStore, s as scimHandler, t as PostgresDirectoryStoreOptions, u as parseScimFilter, v as DirectoryGroup, w as ERROR_SCHEMA, x as DirectoryStore, y as DirectoryMembershipSourceOptions } from "../index-CZ5mixHO.js";
+import { A as ScimFilter, C as DirectoryUser, D as PATCH_SCHEMA, E as LIST_SCHEMA, F as ScimTokenOptions, I as USER_SCHEMA, L as isDirectoryNotFoundError, M as ScimPage, N as ScimPageResult, O as ROLES_EXTENSION, P as ScimPatchOp, R as isDirectoryUniquenessError, S as DirectoryUniquenessError, T as GROUP_SCHEMA, _ as DirectoryChange, a as normalizePatchOps, b as DirectoryNotFoundError, c as filterSupported, d as resourceTypes, f as schemas, g as APP_DATA_EXTENSION, h as sha256Hex, i as directoryMembershipSource, j as ScimHandlerOptions, k as SCIM_CONTENT_TYPE, l as matchFilter, m as authenticateScim, n as postgresDirectoryStore, o as tenantFromPath, p as serviceProviderConfig, r as memoryDirectoryStore, s as scimHandler, t as PostgresDirectoryStoreOptions, u as parseScimFilter, v as DirectoryGroup, w as ERROR_SCHEMA, x as DirectoryStore, y as DirectoryMembershipSourceOptions } from "../index-Dfv9Toct.js";
 export { APP_DATA_EXTENSION, type DirectoryChange, type DirectoryGroup, type DirectoryMembershipSourceOptions, DirectoryNotFoundError, type DirectoryStore, DirectoryUniquenessError, type DirectoryUser, ERROR_SCHEMA, GROUP_SCHEMA, LIST_SCHEMA, PATCH_SCHEMA, type PostgresDirectoryStoreOptions, ROLES_EXTENSION, SCIM_CONTENT_TYPE, type ScimFilter, type ScimHandlerOptions, type ScimPage, type ScimPageResult, type ScimPatchOp, type ScimTokenOptions, type SqlQuery, USER_SCHEMA, authenticateScim, directoryMembershipSource, filterSupported, isDirectoryNotFoundError, isDirectoryUniquenessError, matchFilter, memoryDirectoryStore, normalizePatchOps, parseScimFilter, postgresDirectoryStore, resourceTypes, schemas, scimHandler, serviceProviderConfig, sha256Hex, tenantFromPath };

package/dist/server/index.d.ts

@@ -1,13 +1,13 @@
-import { n as PermDockValidationError, t as PROBLEM_BASE } from "../validation-error-DpvsBwZJ.js";
-import { i as PermDockRevokedError, n as PermDockApprovalRequiredError, r as PermDockDeniedError, t as ApprovalHint } from "../errors-Dc9FdamT.js";
+import { n as PermDockValidationError, t as PROBLEM_BASE } from "../validation-error-Dx8PipbO.js";
+import { i as PermDockRevokedError, n as PermDockApprovalRequiredError, r as PermDockDeniedError, t as ApprovalHint } from "../errors-TpzkEKgJ.js";
 import { t as RequestContext } from "../request-context-C2_1lchh.js";
 import { i as memoryRevocationFeed, n as RevocationFeed, t as RevocationEvent } from "../revocations-BaUXHM1N.js";
-import { C as TenantScope, D as ConnectionOptions, E as ConnectionData, S as TenantOption, T as Connection, _ as WebBotAuthVerifier, a as OperationScopes, b as invalidSignatureResponse, c as ServerPermDock, d as DiscoverViaSignatureAgentOptions, f as InvalidSignatureError, g as WebBotAuthOptions, h as WebBotAuthKeys, i as OpenApiHooks, l as ServerPermDockOptions, m as WebBotAuthKeyLookup, n as DeniedResponseEvent, o as ProtectOptions, p as WebBotAuthJwk, r as Guard, s as ScopeGuard, t as DeniedResponse, u as SnapshotQuery, v as discoverViaSignatureAgent, w as tenantScope, x as webBotAuthVerifier, y as invalidSignatureProblem } from "../server-types-Bw-lWqzR.js";
-import { i as evaluationsHandler } from "../evaluations-BasA9zXp.js";
-import { C as subjectFromApiKey, E as createPermDock, S as parseFeedKey, T as problemFromError, _ as generateApiKey, a as SupportSessionContext, b as memoryCredentialStore, c as SupportSessionSubjectOptions, d as ApiKeyFailureCause, f as ApiKeyParts, g as apiKeyVerifier, h as StoredCredential, i as wwwAuthenticate, l as signSupportSession, m as MemoryCredentialStore, n as problemResponse, o as SupportSessionFailureCause, p as ApiKeySubjectOptions, r as validationProblem, s as SupportSessionSource, t as problemFromDecision, u as subjectFromSupportSession, v as generateFeedKey, w as ProblemFromErrorOptions, x as parseApiKey, y as hashApiKey } from "../index-DtGtDzjb.js";
-import { l as ReplayStore } from "../types-CJC1aaoJ.js";
-import { a as WebhookInput, c as WebhookMessage, d as WebhookSigningKey, f as WebhookVerifier, h as webhookVerifier, i as WebhookHeaders, l as WebhookSigner, m as webhookSigner, n as WebhookAlgorithm, o as WebhookJwk, p as WebhookVerifierOptions, r as WebhookFailureCause, s as WebhookJwks, t as VerifiedWebhookMessage, u as WebhookSignerOptions } from "../standard-webhooks-BFeEpjxy.js";
-import { t as memoryReplayStore } from "../replay-Dc3d8LhG.js";
-import { a as snapshotHeaders, i as cacheLifeFor, n as SnapshotHeaders, o as snapshotKey, r as SnapshotHeadersOptions, s as snapshotTag, t as CacheLifeForOptions } from "../snapshot-cache-Dbk-Gnij.js";
-import { _ as subjectFromRunTicket, a as RunContext, c as RunResource, d as RunTicketFailureCause, f as RunTicketInput, g as signRunTicket, h as parseRunTicket, i as RunBinding, l as RunTicket, m as RunTicketSubjectOptions, n as RunActClaim, o as RunKind, p as RunTicketOptions, r as RunAutomation, s as RunPrincipal, t as RUN_TICKET_CLAIMS, u as RunTicketAutomations } from "../run-ticket-C6lXvHM_.js";
+import { C as TenantScope, D as ConnectionOptions, E as ConnectionData, S as TenantOption, T as Connection, _ as WebBotAuthVerifier, a as OperationScopes, b as invalidSignatureResponse, c as ServerPermDock, d as DiscoverViaSignatureAgentOptions, f as InvalidSignatureError, g as WebBotAuthOptions, h as WebBotAuthKeys, i as OpenApiHooks, l as ServerPermDockOptions, m as WebBotAuthKeyLookup, n as DeniedResponseEvent, o as ProtectOptions, p as WebBotAuthJwk, r as Guard, s as ScopeGuard, t as DeniedResponse, u as SnapshotQuery, v as discoverViaSignatureAgent, w as tenantScope, x as webBotAuthVerifier, y as invalidSignatureProblem } from "../server-types-3OnXjZ2D.js";
+import { i as evaluationsHandler } from "../evaluations-CisTTURl.js";
+import { C as subjectFromApiKey, E as createPermDock, S as parseFeedKey, T as problemFromError, _ as generateApiKey, a as SupportSessionContext, b as memoryCredentialStore, c as SupportSessionSubjectOptions, d as ApiKeyFailureCause, f as ApiKeyParts, g as apiKeyVerifier, h as StoredCredential, i as wwwAuthenticate, l as signSupportSession, m as MemoryCredentialStore, n as problemResponse, o as SupportSessionFailureCause, p as ApiKeySubjectOptions, r as validationProblem, s as SupportSessionSource, t as problemFromDecision, u as subjectFromSupportSession, v as generateFeedKey, w as ProblemFromErrorOptions, x as parseApiKey, y as hashApiKey } from "../index-rFp6X_QP.js";
+import { l as ReplayStore } from "../types-Ck1KOfug.js";
+import { a as WebhookInput, c as WebhookMessage, d as WebhookSigningKey, f as WebhookVerifier, h as webhookVerifier, i as WebhookHeaders, l as WebhookSigner, m as webhookSigner, n as WebhookAlgorithm, o as WebhookJwk, p as WebhookVerifierOptions, r as WebhookFailureCause, s as WebhookJwks, t as VerifiedWebhookMessage, u as WebhookSignerOptions } from "../standard-webhooks-BfPaZ6T1.js";
+import { t as memoryReplayStore } from "../replay-E5X9E1lC.js";
+import { a as snapshotHeaders, i as cacheLifeFor, n as SnapshotHeaders, o as snapshotKey, r as SnapshotHeadersOptions, s as snapshotTag, t as CacheLifeForOptions } from "../snapshot-cache-B4YvlGG_.js";
+import { _ as subjectFromRunTicket, a as RunContext, c as RunResource, d as RunTicketFailureCause, f as RunTicketInput, g as signRunTicket, h as parseRunTicket, i as RunBinding, l as RunTicket, m as RunTicketSubjectOptions, n as RunActClaim, o as RunKind, p as RunTicketOptions, r as RunAutomation, s as RunPrincipal, t as RUN_TICKET_CLAIMS, u as RunTicketAutomations } from "../run-ticket-DPaD27_r.js";
 export { type ApiKeyFailureCause, type ApiKeyParts, type ApiKeySubjectOptions, type ApprovalHint, type CacheLifeForOptions, type Connection, type ConnectionData, type ConnectionOptions, type DeniedResponse, type DeniedResponseEvent, type DiscoverViaSignatureAgentOptions, type Guard, InvalidSignatureError, type MemoryCredentialStore, type OpenApiHooks, type OperationScopes, PROBLEM_BASE, PermDockApprovalRequiredError, PermDockDeniedError, PermDockRevokedError, PermDockValidationError, type ProblemFromErrorOptions, type ProtectOptions, RUN_TICKET_CLAIMS, type ReplayStore, type RequestContext, type RevocationEvent, type RevocationFeed, type RunActClaim, type RunAutomation, type RunBinding, type RunContext, type RunKind, type RunPrincipal, type RunResource, type RunTicket, type RunTicketAutomations, type RunTicketFailureCause, type RunTicketInput, type RunTicketOptions, type RunTicketSubjectOptions, type ScopeGuard, type ServerPermDock, type ServerPermDockOptions, type SnapshotHeaders, type SnapshotHeadersOptions, type SnapshotQuery, type StoredCredential, type SupportSessionContext, type SupportSessionFailureCause, type SupportSessionSource, type SupportSessionSubjectOptions, type TenantOption, type TenantScope, type VerifiedWebhookMessage, type WebBotAuthJwk, type WebBotAuthKeyLookup, type WebBotAuthKeys, type WebBotAuthOptions, type WebBotAuthVerifier, type WebhookAlgorithm, type WebhookFailureCause, type WebhookHeaders, type WebhookInput, type WebhookJwk, type WebhookJwks, type WebhookMessage, type WebhookSigner, type WebhookSignerOptions, type WebhookSigningKey, type WebhookVerifier, type WebhookVerifierOptions, apiKeyVerifier, cacheLifeFor, createPermDock, discoverViaSignatureAgent, evaluationsHandler, generateApiKey, generateFeedKey, hashApiKey, invalidSignatureProblem, invalidSignatureResponse, memoryCredentialStore, memoryReplayStore, memoryRevocationFeed, parseApiKey, parseFeedKey, parseRunTicket, problemFromDecision, problemFromError, problemResponse, signRunTicket, signSupportSession, snapshotHeaders, snapshotKey, snapshotTag, subjectFromApiKey, subjectFromRunTicket, subjectFromSupportSession, tenantScope, validationProblem, webBotAuthVerifier, webhookSigner, webhookVerifier, wwwAuthenticate };

package/dist/server/index.js

@@ -4,11 +4,11 @@ import { t as memoryRevocationFeed } from "../revocations-Bhr0aMIC.js";
 import { c as problemFromDecision, f as validationProblem, l as problemResponse, p as wwwAuthenticate } from "../problem-BVLHFK33.js";
 import { t as memoryReplayStore } from "../replay-BU09ad4L.js";
 import { i as snapshotTag, n as snapshotHeaders, r as snapshotKey, t as cacheLifeFor } from "../snapshot-cache-B66h7FBK.js";
-import { d as invalidSignatureProblem, f as invalidSignatureResponse, l as InvalidSignatureError, o as evaluationsHandler, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-DG40eSJa.js";
+import { d as invalidSignatureProblem, f as invalidSignatureResponse, l as InvalidSignatureError, o as evaluationsHandler, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-h3KoJAPa.js";
 import { n as tenantScope } from "../adapter-context-OHikyRqV.js";
-import { t as createPermDock } from "../create-jCPwPWXf.js";
+import { t as createPermDock } from "../create-3A7J9KRR.js";
 import { a as generateFeedKey, c as parseApiKey, i as generateApiKey, l as parseFeedKey, n as subjectFromSupportSession, o as hashApiKey, r as apiKeyVerifier, s as memoryCredentialStore, t as signSupportSession, u as subjectFromApiKey } from "../server-D0PW6ZCw.js";
 import { i as subjectFromRunTicket, n as parseRunTicket, r as signRunTicket, t as RUN_TICKET_CLAIMS } from "../run-ticket-CjvXr6wj.js";
-import { t as problemFromError } from "../map-error-B_f3C5cs.js";
+import { t as problemFromError } from "../map-error-BH16Ah8P.js";
 import { n as webhookVerifier, t as webhookSigner } from "../standard-webhooks-D67a3nzk.js";
 export { InvalidSignatureError, PROBLEM_BASE, PermDockApprovalRequiredError, PermDockDeniedError, PermDockRevokedError, PermDockValidationError, RUN_TICKET_CLAIMS, apiKeyVerifier, cacheLifeFor, createPermDock, discoverViaSignatureAgent, evaluationsHandler, generateApiKey, generateFeedKey, hashApiKey, invalidSignatureProblem, invalidSignatureResponse, memoryCredentialStore, memoryReplayStore, memoryRevocationFeed, parseApiKey, parseFeedKey, parseRunTicket, problemFromDecision, problemFromError, problemResponse, signRunTicket, signSupportSession, snapshotHeaders, snapshotKey, snapshotTag, subjectFromApiKey, subjectFromRunTicket, subjectFromSupportSession, tenantScope, validationProblem, webBotAuthVerifier, webhookSigner, webhookVerifier, wwwAuthenticate };

package/dist/{server-types-Bw-lWqzR.d.ts → server-types-3OnXjZ2D.d.ts}

@@ -1,14 +1,14 @@
-import { $t as Snapshot, Kt as Instant, M as PolicyVocabulary, Z as Intent, hr as JsonWebKeyLike, qn as Decision, sr as Actor, yr as Subject } from "./policy-types-IRJVABmm.js";
+import { $t as Snapshot, Kt as Instant, M as PolicyVocabulary, Z as Intent, hr as JsonWebKeyLike, qn as Decision, sr as Actor, yr as Subject } from "./policy-types-D-GwfQTc.js";
 import { u as Permission } from "./permission-types-CAY-GU7e.js";
-import { a as PermDock, u as SnapshotOptions } from "./permdock-DUWZEOLR.js";
-import { m as ApprovalStore } from "./types-BvBbkAu1.js";
-import { a as ProblemDetails, t as ApprovalHint } from "./errors-Dc9FdamT.js";
-import { t as InstanceOptions } from "./instance-options-BOCRxEFb.js";
+import { a as PermDock, u as SnapshotOptions } from "./permdock-ffY4CMd9.js";
+import { m as ApprovalStore } from "./types-CqcsNCaN.js";
+import { a as ProblemDetails, t as ApprovalHint } from "./errors-TpzkEKgJ.js";
+import { t as InstanceOptions } from "./instance-options-2sFGSdsf.js";
 import { t as RequestContext } from "./request-context-C2_1lchh.js";
-import { n as PermDockWrap } from "./wrap-DpZAbxuD.js";
+import { n as PermDockWrap } from "./wrap-BHGA-SMM.js";
 import { n as RevocationFeed } from "./revocations-BaUXHM1N.js";
-import { r as PdpFactory } from "./types-B3BOcI0J.js";
-import { i as evaluationsHandler } from "./evaluations-BasA9zXp.js";
+import { r as PdpFactory } from "./types-B8qUkGja.js";
+import { i as evaluationsHandler } from "./evaluations-CisTTURl.js";
 //#region src/server/connection.d.ts
 type ConnectionData<T> = T | (() => T | null | undefined | Promise<T | null | undefined>);
 type ConnectionOptions<T = unknown> = {

package/dist/{sink-DUzt0e4B.d.ts → sink-ogbVkyeo.d.ts}

@@ -1,7 +1,7 @@
-import { Y as DecisionSink, gt as TokenSigner, hn as SinkEvent, in as AccessEvent, jt as Credential, mn as MembershipEvent, on as AutomationEvent, sn as CredentialEvent, wt as SupportSession } from "./policy-types-IRJVABmm.js";
+import { Y as DecisionSink, gt as TokenSigner, hn as SinkEvent, in as AccessEvent, jt as Credential, mn as MembershipEvent, on as AutomationEvent, sn as CredentialEvent, wt as SupportSession } from "./policy-types-D-GwfQTc.js";
 import { M as AppData } from "./permission-types-CAY-GU7e.js";
 import { u as OperationRisk } from "./operations-Ci_rT6Uo.js";
-import { t as Automation } from "./automation-DCWuVKtd.js";
+import { t as Automation } from "./automation-Bfa_wD1h.js";
 //#region src/core/sink.d.ts
 /**
  * The closed list of CloudEvents `type` values, `com.permdock.<family>` or

package/dist/{skills-BUuH-QFt.js → skills-B4MPRxQd.js}

@@ -2,7 +2,7 @@ import { t as byCodePoint } from "./compare-DTfyUunF.js";
 import { i as readJsonFile } from "./files-BSjrtIHw.js";
 import { l as packageRoot } from "./version-DMQ0dnN5.js";
 import { t as didYouMean } from "./args-iafbHiXn.js";
-import { a as nonEmptyOr } from "./output-DhTpe8v1.js";
+import { a as nonEmptyOr } from "./output-BFWLER4r.js";
 import { cpSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, realpathSync, writeFileSync } from "node:fs";
 import { basename, dirname, join, relative, resolve } from "node:path";
 import { pathToFileURL } from "node:url";

package/dist/{skills-a4N6Y2Xm.js → skills-C9sTD70r.js}

@@ -1,7 +1,7 @@
 import { t as defineLeaf } from "./command-L8EstFNm.js";
 import { t as checkFlag } from "./flags-BlmpmXoY.js";
 import { r as pick, t as CANCELLED } from "./prompt-BYc6drYW.js";
-import { n as detectedAgents, r as runSkills, t as SKILL_AGENTS } from "./skills-BUuH-QFt.js";
+import { n as detectedAgents, r as runSkills, t as SKILL_AGENTS } from "./skills-B4MPRxQd.js";
 //#region src/cli/commands/skills.ts
 const forFlag = { for: {
 	type: "string",

package/dist/{snapshot-cache-Dbk-Gnij.d.ts → snapshot-cache-B4YvlGG_.d.ts}

@@ -1,4 +1,4 @@
-import { $t as Snapshot, Kt as Instant } from "./policy-types-IRJVABmm.js";
+import { $t as Snapshot, Kt as Instant } from "./policy-types-D-GwfQTc.js";
 //#region src/core/snapshot-cache.d.ts
 type CacheLifeForOptions = {
   /**