permdock 0.17.0 → 0.18.0

package/dist/{casbin-DFzk_so3.js → casbin-DCQHkkyj.js}

@@ -16,7 +16,7 @@ const casbinImport = defineLeaf({
 		...outFlag
 	},
 	async run(ctx, { flags }) {
-		const { runCasbinImport } = await import("./casbin-C3O_O9nu.js");
+		const { runCasbinImport } = await import("./casbin-bKC1FpEx.js");
 		return runCasbinImport({
 			cwd: ctx.cwd,
 			model: given(flags.model),

package/dist/{casbin-C3O_O9nu.js → casbin-bKC1FpEx.js}

@@ -1,4 +1,4 @@
-import { a as nonEmptyOr } from "./output-DhTpe8v1.js";
+import { a as nonEmptyOr } from "./output-BFWLER4r.js";
 import { t as applyFiles } from "./files-CfiRtQ-m.js";
 import { n as isIdentifier, t as emitPolicyModule } from "./policy-module-xym9fnSq.js";
 import { existsSync, readFileSync } from "node:fs";

package/dist/catalog/index.d.ts

@@ -1,8 +1,8 @@
-import { E as Policy, _r as Principal, o as ApprovalRequirement } from "../policy-types-IRJVABmm.js";
-import { c as checkHostedGrant, n as HostedGrantCheck, o as PolicyDocument } from "../hosted-DxRLLiFU.js";
+import { E as Policy, _r as Principal, o as ApprovalRequirement } from "../policy-types-D-GwfQTc.js";
+import { c as checkHostedGrant, n as HostedGrantCheck, o as PolicyDocument } from "../hosted-BFNXwcjd.js";
 import { a as CatalogDocument, c as CatalogOperation, d as CatalogRole, f as CatalogScope, h as CatalogValidity, i as CatalogDelegation, l as CatalogPermission, m as CatalogUsage, n as CatalogApproval, o as CatalogGrant, p as CatalogSupportAccess, r as CatalogBreakGlass, s as CatalogOAuthScope, t as CatalogActivation, u as CatalogResource } from "../types-NYoj8JBm.js";
-import { a as CatalogFinding, i as CatalogEventData } from "../sink-DUzt0e4B.js";
-import { a as pushedPolicy, i as parsePushedPolicy, n as PushedGrant, r as PushedPolicy, t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-CUQuvlS3.js";
+import { a as CatalogFinding, i as CatalogEventData } from "../sink-ogbVkyeo.js";
+import { a as pushedPolicy, i as parsePushedPolicy, n as PushedGrant, r as PushedPolicy, t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-Ck3FZcoy.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/catalog/drift.d.ts
 /**

package/dist/catalog/index.js

@@ -3,12 +3,12 @@ import { n as freezeDeep } from "../freeze-jjan0lCv.js";
 import { a as getResource, n as findPermission } from "../permission-registry-B8tYxPIt.js";
 import { d as isSelfParented } from "../resource-relations-8-pCScBO.js";
 import { _ as listPlans, m as findRole } from "../grantee-Dke-9rd1.js";
-import { n as declaredRoleNames } from "../policy-DxQyHKPB.js";
-import { i as hostedGrantDrops, n as codeApprovals, r as declaredGrantee, t as checkHostedGrant } from "../hosted-tPZnyjQS.js";
+import { n as declaredRoleNames } from "../policy-cV_wwPb8.js";
+import { i as hostedGrantDrops, n as codeApprovals, r as declaredGrantee, t as checkHostedGrant } from "../hosted-waouw2V-.js";
 import { n as rowConditionKeys, t as parseCatalog } from "../parse-UTC-sDrt.js";
-import { t as operationFindings } from "../operation-findings-CXtFzlKJ.js";
-import { n as resourceSchemaFromJson, t as policyFromCatalog } from "../policy-from-catalog-DVa1faOr.js";
-import { n as parsePushedPolicy, r as pushedPolicy, t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-DMXAOmEW.js";
+import { t as operationFindings } from "../operation-findings-CVwJHEu_.js";
+import { n as resourceSchemaFromJson, t as policyFromCatalog } from "../policy-from-catalog-B68hGC0S.js";
+import { n as parsePushedPolicy, r as pushedPolicy, t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-BecMsTtM.js";
 //#region src/catalog/drift.ts
 /**
 * The finding a drop reason becomes; `null` for a reason the catalog did not

package/dist/catalog-Caqhbdix.js

@@ -0,0 +1 @@
+export { t as catalogFile, n as runCatalog } from "./catalog-D1fw8qif.js";

package/dist/{catalog-DGDd_ww1.js → catalog-D1fw8qif.js}

@@ -2,8 +2,8 @@ import { r as isRecord } from "./compact-CAf557ZB.js";
 import { r as listSourceFiles, t as defaultSrcPath } from "./files-BSjrtIHw.js";
 import { a as catalogSchemaDocument, n as catalogForCompare, o as formatCatalogJson, r as catalogForDrift, s as formatCatalogMarkdown, t as buildCatalog } from "./catalog-doc-C4DGfJCO.js";
 import { a as loadModule, i as loadConfiguredPolicy, r as leavesOf, s as pickNamed, t as asPermissionTree } from "./load-BaEamml-.js";
-import { t as loadConfiguredOperations } from "./catalog-operations-DVI5QO5R.js";
-import { i as scanSources, r as runCollect } from "./collect-HfJXl8Tr.js";
+import { t as loadConfiguredOperations } from "./catalog-operations-BD22drQf.js";
+import { i as scanSources, r as runCollect } from "./collect-D878zLDP.js";
 import { n as fileSummary, t as applyFiles } from "./files-CfiRtQ-m.js";
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";

package/dist/{catalog-operations-DVI5QO5R.js → catalog-operations-BD22drQf.js}

@@ -1,7 +1,7 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
-import { j as isOperationEffect } from "./src-nYNBfmgq.js";
 import { o as isPermission } from "./permission-registry-B8tYxPIt.js";
-import { r as isOperationRisk } from "./permissions-CVXmRILq.js";
+import { n as isOperationRisk } from "./operation-risks-BKOcTv8J.js";
+import { n as isOperationEffect } from "./operations-Bm9HFecz.js";
 import { i as configError } from "./errors-BhRkoNS7.js";
 import { a as rel } from "./files-BSjrtIHw.js";
 import { a as loadModule, s as pickNamed } from "./load-BaEamml-.js";

package/dist/{catalog-DJJIkR9P.js → catalog-zzNuR3sY.js}

@@ -30,7 +30,7 @@ const catalog = defineLeaf({
 		...checkFlag
 	},
 	async run(ctx, { flags }) {
-		const { catalogFile, runCatalog } = await import("./catalog-BpnjesqX.js");
+		const { catalogFile, runCatalog } = await import("./catalog-Caqhbdix.js");
 		const result = await runCatalog({
 			cwd: ctx.cwd,
 			config: ctx.config,

package/dist/{challenge-M_ghKJnT.js → challenge-B2O2OLEk.js}

@@ -1,7 +1,7 @@
 import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-jjan0lCv.js";
 import { i as dateAt, p as nowSeconds } from "./time-nR1JesoH.js";
-import { u as policyDocumentFromClaims } from "./hosted-tPZnyjQS.js";
+import { u as policyDocumentFromClaims } from "./hosted-waouw2V-.js";
 import { l as isApprovalErrorCode, s as ApprovalError, t as APPROVAL_HEADER } from "./types-CcUXciSj.js";
 import { h as toCloudEvent, l as isAbsoluteUri } from "./sink-D9_vh372.js";
 import { n as parseCatalogEventData, t as catalogFingerprint } from "./catalog-fingerprint-e6aCWosn.js";

package/dist/chat/index.d.ts

@@ -1,2 +1,2 @@
-import { a as ChatCommandResult, c as createPermDock, d as SubjectFromChatOptions, f as isChatAuthor, i as ChatCommandContext, l as ChatAuthor, n as ChatActionResult, o as ChatPermDock, p as subjectFromChat, r as ChatCommand, s as ChatPermDockOptions, t as ChatAction, u as ChatPrincipal } from "../create-DNN3OtsO.js";
+import { a as ChatCommandResult, c as createPermDock, d as SubjectFromChatOptions, f as isChatAuthor, i as ChatCommandContext, l as ChatAuthor, n as ChatActionResult, o as ChatPermDock, p as subjectFromChat, r as ChatCommand, s as ChatPermDockOptions, t as ChatAction, u as ChatPrincipal } from "../create-CtoT1lIQ.js";
 export { type ChatAction, type ChatActionResult, type ChatAuthor, type ChatCommand, type ChatCommandContext, type ChatCommandResult, type ChatPermDock, type ChatPermDockOptions, type ChatPrincipal, type SubjectFromChatOptions, createPermDock, isChatAuthor, subjectFromChat };

package/dist/chat/index.js

@@ -2,9 +2,9 @@ import { t as compact } from "../compact-CAf557ZB.js";
 import { n as freezeDeep } from "../freeze-jjan0lCv.js";
 import { n as loadPrincipalByIdentity } from "../principal-source-C6N60GtM.js";
 import { f as nowMillis } from "../time-nR1JesoH.js";
-import { l as withApp, t as getPermDock } from "../permdock-DdzMv5-F.js";
+import { l as withApp, t as getPermDock } from "../permdock-D-_WrdKu.js";
 import { c as isApprovalError } from "../types-CcUXciSj.js";
-import { a as requestApproval, o as resolveApproval, s as resumeDecision } from "../helpers-DNnZffrI.js";
+import { a as requestApproval, o as resolveApproval, s as resumeDecision } from "../helpers-DmqGy63f.js";
 import { t as approvalPrompt } from "../approval-prompt-B8hQY69x.js";
 //#region src/chat/subject.ts
 function nonEmpty(value) {

package/dist/chat-sdk/index.d.ts

@@ -1,6 +1,6 @@
-import { n as ApprovalUrl, t as ApprovalPrompt } from "../approval-prompt-BSh-yxbH.js";
-import { l as ChatAuthor, n as ChatActionResult, o as ChatPermDock } from "../create-DNN3OtsO.js";
-import { n as ChatTransport } from "../types-UfpcY575.js";
+import { n as ApprovalUrl, t as ApprovalPrompt } from "../approval-prompt-Bg7gDSqd.js";
+import { l as ChatAuthor, n as ChatActionResult, o as ChatPermDock } from "../create-CtoT1lIQ.js";
+import { n as ChatTransport } from "../types-CCEeSCMB.js";
 import { ActionEvent, Author, CardElement } from "chat";
 //#region src/chat-sdk/author.d.ts
 type ChatSdkAuthorOptions = {

package/dist/claude-agent/index.d.ts

@@ -1,6 +1,6 @@
-import { E as Policy, M as PolicyVocabulary, _r as Principal } from "../policy-types-IRJVABmm.js";
-import { a as PermDock } from "../permdock-DUWZEOLR.js";
-import { o as AgentAdapterOptions, t as AgentPermDock } from "../create-bzQlBzG4.js";
+import { E as Policy, M as PolicyVocabulary, _r as Principal } from "../policy-types-D-GwfQTc.js";
+import { a as PermDock } from "../permdock-ffY4CMd9.js";
+import { o as AgentAdapterOptions, t as AgentPermDock } from "../create-BzwjZuRS.js";
 //#region src/claude-agent/create.d.ts
 /** Structural `McpServerProvenance` from `@anthropic-ai/claude-agent-sdk`. */
 type ClaudeMcpServer = {

package/dist/claude-agent/index.js

@@ -1,6 +1,6 @@
 import { r as isRecord, t as compact } from "../compact-CAf557ZB.js";
-import { l as withApp } from "../permdock-DdzMv5-F.js";
-import { t as agentRuntime } from "../create-gqtDb1nU.js";
+import { l as withApp } from "../permdock-D-_WrdKu.js";
+import { t as agentRuntime } from "../create-C-tm3KIF.js";
 //#region src/claude-agent/create.ts
 const MCP_PREFIX = "mcp__";
 function asInput(input) {

package/dist/clerk/index.d.ts

@@ -1,6 +1,6 @@
-import { K as CustomRoleSource, _r as Principal, yr as Subject } from "../policy-types-IRJVABmm.js";
+import { K as CustomRoleSource, _r as Principal, yr as Subject } from "../policy-types-D-GwfQTc.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { s as RemotePdpCache } from "../types-B3BOcI0J.js";
+import { s as RemotePdpCache } from "../types-B8qUkGja.js";
 import { t as ClaimsMap } from "../claims-map-D1Pb5oRq.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/clerk/types.d.ts

package/dist/cli/bin.js

@@ -11,7 +11,7 @@ if (argv.length === 1 && (argv[0] === "--version" || argv[0] === "-v")) {
 	const [{ isCi }, { trapSignals }, { run }, { streamHasColors }] = await Promise.all([
 		import("../env-DJZrPjRi.js"),
 		import("../signals-B1vHR3fN.js"),
-		import("../run-D9N6V5WQ.js"),
+		import("../run-UPbacxPg.js"),
 		import("../style-DblOtSga.js")
 	]);
 	const signals = trapSignals();

package/dist/cli/index.d.ts

@@ -1,10 +1,10 @@
-import { E as Policy } from "../policy-types-IRJVABmm.js";
+import { E as Policy } from "../policy-types-D-GwfQTc.js";
 import { f as PermissionTree } from "../permission-types-CAY-GU7e.js";
 import { o as OperationMap } from "../operations-Ci_rT6Uo.js";
 import { a as CatalogDocument, d as CatalogRole, f as CatalogScope, l as CatalogPermission, m as CatalogUsage, n as CatalogApproval, p as CatalogSupportAccess, r as CatalogBreakGlass, t as CatalogActivation, u as CatalogResource } from "../types-NYoj8JBm.js";
-import { a as pushedPolicy, i as parsePushedPolicy, n as PushedGrant, r as PushedPolicy, t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-CUQuvlS3.js";
-import { _ as RlsSuspension, a as GenKind, c as RlsActiveRow, d as RlsDialect, f as RlsFunctionMapping, g as RlsSuspendedScope, h as RlsSuspendedMembership, i as GenConfig, l as RlsApiKeys, m as RlsMemberships, n as CliIo, o as PermDockConfig, p as RlsMembershipTable, r as CollectConfig, t as CatalogConfig, u as RlsConfig, v as RlsTarget, y as RunResult } from "../types-CAAN7evk.js";
-import { o as ResourceNameOf, r as PermissionKeyOf, s as ScopeNameOf, t as ActionNameOf } from "../type-helpers-C_OnZW8c.js";
+import { a as pushedPolicy, i as parsePushedPolicy, n as PushedGrant, r as PushedPolicy, t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-Ck3FZcoy.js";
+import { _ as RlsSuspension, a as GenKind, c as RlsActiveRow, d as RlsDialect, f as RlsFunctionMapping, g as RlsSuspendedScope, h as RlsSuspendedMembership, i as GenConfig, l as RlsApiKeys, m as RlsMemberships, n as CliIo, o as PermDockConfig, p as RlsMembershipTable, r as CollectConfig, t as CatalogConfig, u as RlsConfig, v as RlsTarget, y as RunResult } from "../types-3Y8UpFkF.js";
+import { o as ResourceNameOf, r as PermissionKeyOf, s as ScopeNameOf, t as ActionNameOf } from "../type-helpers-i1EJ3Eb1.js";
 //#region src/cli/catalog-path.d.ts
 /**
  * The absolute path `permdock collect` writes the catalog to: `collect.out`,

package/dist/cli/index.js

@@ -1,8 +1,8 @@
 import { t as catalogPath } from "../catalog-path-CnI0XTFK.js";
 import { t as defineConfig } from "../config-COHmivz9.js";
-import { n as parsePushedPolicy, r as pushedPolicy, t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-DMXAOmEW.js";
+import { n as parsePushedPolicy, r as pushedPolicy, t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-BecMsTtM.js";
 import { c as parseGrantsMarker, l as parseHookMarker } from "../markers-BeHZ4x9Q.js";
-import { t as run } from "../run-CnCaTjWX.js";
+import { t as run } from "../run-B7lv3NuK.js";
 //#region src/cli/token-schemas.ts
 const ID = {
 	type: "string",

package/dist/client-CH7vzSAY.d.ts

@@ -0,0 +1,32 @@
+import { r as RefreshTrigger } from "./refresh-on-L9UOwATg.js";
+//#region src/supabase/client.d.ts
+/** The part of a supabase-js `RealtimeChannel` the trigger uses. */
+type RealtimeRefreshChannel = {
+  readonly on: (type: "broadcast", filter: {
+    readonly event: string;
+  }, callback: (message: unknown) => void) => unknown;
+  readonly subscribe: () => unknown;
+};
+/** The part of a browser supabase-js client the trigger uses. */
+type RealtimeRefreshClient<C extends RealtimeRefreshChannel = RealtimeRefreshChannel> = {
+  readonly channel: (topic: string, options: {
+    readonly config: {
+      readonly private: boolean;
+    };
+  }) => C;
+  readonly removeChannel: (channel: C) => unknown;
+};
+type SupabaseRealtimeRefreshOptions = {
+  /** The signed-in user's id, the `sub` of their token. */
+  readonly userId: string;
+};
+/**
+ * A `refreshOn` trigger on the user's private `authz:<uid>` Realtime topic,
+ * where the generated version trigger sends each bump, for apps without
+ * better-supabase. The `realtime.messages` receive policy from
+ * `supabase.hook.broadcast` lets each user join only their own topic. With
+ * better-supabase, use `authzChangeRefresh` on `SessionProvider` instead.
+ */
+declare function supabaseRealtimeRefresh<C extends RealtimeRefreshChannel>(client: RealtimeRefreshClient<C>, options: SupabaseRealtimeRefreshOptions): RefreshTrigger;
+//#endregion
+export { supabaseRealtimeRefresh as i, RealtimeRefreshClient as n, SupabaseRealtimeRefreshOptions as r, RealtimeRefreshChannel as t };

package/dist/cloud/index.d.ts

@@ -1,11 +1,11 @@
-import { Kt as Instant, cn as DecisionEvent, fn as DirectoryEvent, gt as TokenSigner, in as AccessEvent, ln as DeliveryChannel, mn as MembershipEvent, on as AutomationEvent, sn as CredentialEvent, un as DeliveryEvent } from "../policy-types-IRJVABmm.js";
-import { m as ApprovalStore } from "../types-BvBbkAu1.js";
-import { i as CatalogEventData, l as CloudEventType, r as CLOUD_EVENT_TYPES, s as CloudEvent } from "../sink-DUzt0e4B.js";
-import { c as DeliveryTransport } from "../types-UfpcY575.js";
-import { a as CloudConnectionOptions, c as CloudOptions, i as CloudClient, l as CloudSignerOptions, n as CloudCatalog, o as CloudEndpointOptions, r as CloudCatalogPush, s as CloudEndpoints, t as CloudApproverOptions } from "../types-CA-A33Q5.js";
-import { n as ApprovalWaiter } from "../waiter-C2cXXLFZ.js";
-import { l as ReplayStore } from "../types-CJC1aaoJ.js";
-import { f as WebhookVerifier, r as WebhookFailureCause$1, s as WebhookJwks } from "../standard-webhooks-BFeEpjxy.js";
+import { Kt as Instant, cn as DecisionEvent, fn as DirectoryEvent, gt as TokenSigner, in as AccessEvent, ln as DeliveryChannel, mn as MembershipEvent, on as AutomationEvent, sn as CredentialEvent, un as DeliveryEvent } from "../policy-types-D-GwfQTc.js";
+import { m as ApprovalStore } from "../types-CqcsNCaN.js";
+import { i as CatalogEventData, l as CloudEventType, r as CLOUD_EVENT_TYPES, s as CloudEvent } from "../sink-ogbVkyeo.js";
+import { c as DeliveryTransport } from "../types-CCEeSCMB.js";
+import { a as CloudConnectionOptions, c as CloudOptions, i as CloudClient, l as CloudSignerOptions, n as CloudCatalog, o as CloudEndpointOptions, r as CloudCatalogPush, s as CloudEndpoints, t as CloudApproverOptions } from "../types-D-JO7lh8.js";
+import { n as ApprovalWaiter } from "../waiter-NK_UuZbb.js";
+import { l as ReplayStore } from "../types-Ck1KOfug.js";
+import { f as WebhookVerifier, r as WebhookFailureCause$1, s as WebhookJwks } from "../standard-webhooks-BfPaZ6T1.js";
 //#region src/cloud/base-url.d.ts
 /**
  * The one base URL of PermDock Cloud. The platform issuer is this URL; its

package/dist/cloud/index.js

@@ -12,7 +12,7 @@ import { c as stringField, n as discoverAuthorizationServer, r as parseToken } f
 import { t as pollingApprovalWaiter } from "../waiter-aBLM63_f.js";
 import { i as isDeliveryTarget } from "../target-qdEAnnhU.js";
 import { t as CLOUD_BASE_URL } from "../base-url-BQbddZO5.js";
-import { a as isCompactJws, i as cloudEndpoints, n as cloud, o as resolveCloudEndpoints, r as cloudConnection, t as bearerChallenge } from "../challenge-M_ghKJnT.js";
+import { a as isCompactJws, i as cloudEndpoints, n as cloud, o as resolveCloudEndpoints, r as cloudConnection, t as bearerChallenge } from "../challenge-B2O2OLEk.js";
 import { n as randomToken, t as pkce } from "../pkce-CnmmYqUZ.js";
 //#region src/cloud/oauth-error.ts
 /**

package/dist/{cloud-DYqzmh5i.js → cloud-C0vXBmLG.js}

@@ -41,7 +41,7 @@ const push = defineLeaf({
 	},
 	async run(ctx, { flags }) {
 		const env = await withStdinSecret(ctx, "key", flags["key-stdin"], "PERMDOCK_CLOUD_KEY");
-		return (await import("./push-eJl1Tvqm.js")).runCloud({
+		return (await import("./push-BSb8j1EW.js")).runCloud({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			url: given(flags.url),
@@ -70,7 +70,7 @@ const pull = defineLeaf({
 	},
 	async run(ctx, { flags }) {
 		const env = await withStdinSecret(ctx, "token", flags["token-stdin"], "PERMDOCK_CLOUD_TOKEN");
-		return (await import("./pull-CUVdB04v.js")).runCloudPull({
+		return (await import("./pull-UBjDnf4b.js")).runCloudPull({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			url: given(flags.url),

package/dist/{codemod-DqB9klYI.js → codemod-C-L0w-u7.js}

@@ -7,7 +7,7 @@ const codemod = defineLeaf({
 		description: "The release to migrate to (0.5)",
 		required: true,
 		async complete() {
-			return (await import("./codemod-DNGMGqBS.js")).codemodVersions();
+			return (await import("./codemod-eYI1FbeJ.js")).codemodVersions();
 		}
 	}, {
 		name: "paths",
@@ -22,7 +22,7 @@ const codemod = defineLeaf({
 		}
 	},
 	async run(ctx, { flags, args, rest }) {
-		return (await import("./codemod-DNGMGqBS.js")).runCodemod({
+		return (await import("./codemod-eYI1FbeJ.js")).runCodemod({
 			cwd: ctx.cwd,
 			version: args["version"],
 			paths: rest,

package/dist/{codemod-DNGMGqBS.js → codemod-eYI1FbeJ.js}

@@ -1,7 +1,7 @@
 import { n as CliError } from "./errors-BhRkoNS7.js";
 import { a as rel } from "./files-BSjrtIHw.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
-import { n as ROOT } from "./manifest-Dij1U0hx.js";
+import { n as ROOT } from "./manifest-wclLWBVH.js";
 import { i as refuseDirty, t as applyFiles } from "./files-CfiRtQ-m.js";
 import { readFileSync, readdirSync, statSync } from "node:fs";
 import { basename, extname, join, resolve } from "node:path";

package/dist/{collect-C44RrKCI.js → collect-CU85z6Ta.js}

@@ -29,9 +29,9 @@ const collect = defineLeaf({
 		};
 		if (flags.watch) {
 			if (flags.check) throw new CliError("usage", "collect: --watch writes the catalog; drop --check", { code: "invalid_value" });
-			return (await import("./watch-DnymTAfe.js")).watchCollect(ctx, overrides);
+			return (await import("./watch-OYwAPCzx.js")).watchCollect(ctx, overrides);
 		}
-		const result = await (await import("./collect-CAibhmCi.js")).runCollect({
+		const result = await (await import("./collect-KCtOigxx.js")).runCollect({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			collect: overrides,

package/dist/{collect-HfJXl8Tr.js → collect-D878zLDP.js}

@@ -2,7 +2,7 @@ import { a as describeError } from "./errors-BhRkoNS7.js";
 import { a as rel, r as listSourceFiles, s as writeFileEnsuringDir, t as defaultSrcPath } from "./files-BSjrtIHw.js";
 import { n as catalogForCompare, o as formatCatalogJson, r as catalogForDrift, t as buildCatalog } from "./catalog-doc-C4DGfJCO.js";
 import { a as loadModule, i as loadConfiguredPolicy, r as leavesOf, s as pickNamed, t as asPermissionTree } from "./load-BaEamml-.js";
-import { t as loadConfiguredOperations } from "./catalog-operations-DVI5QO5R.js";
+import { t as loadConfiguredOperations } from "./catalog-operations-BD22drQf.js";
 import { t as catalogPath } from "./catalog-path-CnI0XTFK.js";
 import { t as shortDiff } from "./text-diff-BtfSmdUo.js";
 import { existsSync, readFileSync } from "node:fs";

package/dist/collect-KCtOigxx.js

@@ -0,0 +1 @@
+export { r as runCollect } from "./collect-D878zLDP.js";

package/dist/compile/index.d.ts

@@ -1,3 +1,3 @@
 import { n as GraphSqlPart, r as RelationsMapping, t as GraphSql } from "../graph-sql-BwFC4Qjs.js";
-import { a as CompiledWhere, c as compileWhere, i as CompiledSql, l as escapeLike, n as CompiledCompare, o as MembershipTable, r as CompiledExists, s as MembershipsMapping, t as CompileWhereOptions } from "../compile-BxiwRotu.js";
+import { a as CompiledWhere, c as compileWhere, i as CompiledSql, l as escapeLike, n as CompiledCompare, o as MembershipTable, r as CompiledExists, s as MembershipsMapping, t as CompileWhereOptions } from "../compile-DBm0ub4p.js";
 export { type CompileWhereOptions, type CompiledCompare, type CompiledExists, type CompiledSql, type CompiledWhere, type GraphSql, type GraphSqlPart, type MembershipTable, type MembershipsMapping, type RelationsMapping, compileWhere, escapeLike };

package/dist/{compile-BxiwRotu.d.ts → compile-DBm0ub4p.d.ts}

@@ -1,6 +1,6 @@
-import { Kt as Instant, bn as Scope, wr as Condition, yr as Subject } from "./policy-types-IRJVABmm.js";
+import { Kt as Instant, bn as Scope, wr as Condition, yr as Subject } from "./policy-types-D-GwfQTc.js";
 import { b as ResourceNode } from "./permission-types-CAY-GU7e.js";
-import { f as WhereResult } from "./permdock-DUWZEOLR.js";
+import { f as WhereResult } from "./permdock-ffY4CMd9.js";
 import { r as RelationsMapping, t as GraphSql } from "./graph-sql-BwFC4Qjs.js";
 //#region src/conditions/compile.d.ts
 type MembershipTable = {

package/dist/{completion-pwVjJlek.js → completion-Dauc6pVT.js}

@@ -1,6 +1,6 @@
 import { n as CliError } from "./errors-BhRkoNS7.js";
 import { a as GLOBAL_FLAGS, i as suggestion } from "./args-iafbHiXn.js";
-import { a as resolve } from "./manifest-Dij1U0hx.js";
+import { a as resolve } from "./manifest-wclLWBVH.js";
 import { t as defineLeaf } from "./command-L8EstFNm.js";
 //#region src/cli/core/completion.ts
 const SHELLS = [

package/dist/{config-DnfH6_eT.js → config-DWp2PucY.js}

@@ -10,7 +10,7 @@ const config = defineLeaf({
 		...failOnFlag
 	},
 	async run(ctx, { flags }) {
-		const { runConfig } = await import("./config-report-C1jl7Na-.js");
+		const { runConfig } = await import("./config-report-DKpFm5ID.js");
 		return runConfig({
 			cwd: ctx.cwd,
 			config: ctx.config,

package/dist/{config-report-C1jl7Na-.js → config-report-DKpFm5ID.js}

@@ -1,9 +1,9 @@
 import { a as rel, t as defaultSrcPath } from "./files-BSjrtIHw.js";
 import { r as CONFIG_REPORT_SCHEMA } from "./version-DMQ0dnN5.js";
 import { t as catalogPath } from "./catalog-path-CnI0XTFK.js";
-import { n as guessPermissions, t as barrelFile } from "./collect-HfJXl8Tr.js";
+import { n as guessPermissions, t as barrelFile } from "./collect-D878zLDP.js";
 import "./sources-C4vkzZJV.js";
-import { t as DOCS_BASE } from "./manifest-Dij1U0hx.js";
+import { t as DOCS_BASE } from "./manifest-wclLWBVH.js";
 import { n as MIGRATION_DIRS, t as DEFAULT_SENSITIVE_ACTIONS } from "./constants-DcJABbLW.js";
 //#region src/cli/config-report.ts
 function configReport(input) {

package/dist/convex/index.d.ts

@@ -1,8 +1,8 @@
-import { E as Policy, M as PolicyVocabulary, _r as Principal } from "../policy-types-IRJVABmm.js";
+import { E as Policy, M as PolicyVocabulary, _r as Principal } from "../policy-types-D-GwfQTc.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { a as PermDock } from "../permdock-DUWZEOLR.js";
-import { a as ProblemDetails, r as PermDockDeniedError } from "../errors-Dc9FdamT.js";
-import { t as InstanceOptions } from "../instance-options-BOCRxEFb.js";
+import { a as PermDock } from "../permdock-ffY4CMd9.js";
+import { a as ProblemDetails, r as PermDockDeniedError } from "../errors-TpzkEKgJ.js";
+import { t as InstanceOptions } from "../instance-options-2sFGSdsf.js";
 //#region src/convex/types.d.ts
 type ConvexContextLike = {
   readonly auth?: {

package/dist/convex/index.js

@@ -1,8 +1,8 @@
 import { t as compact } from "../compact-CAf557ZB.js";
 import { n as PermDockValidationError } from "../validation-error-CYg2kJEw.js";
 import { n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "../errors-B6R_lg2a.js";
-import { l as withApp } from "../permdock-DdzMv5-F.js";
-import { n as resolveOrNull, t as buildInstance } from "../build-instance-lye7oEqf.js";
+import { l as withApp } from "../permdock-D-_WrdKu.js";
+import { n as resolveOrNull, t as buildInstance } from "../build-instance-BFMFQdE_.js";
 import { n as tenantScope, t as actorFrom } from "../adapter-context-OHikyRqV.js";
 //#region src/convex/create.ts
 /**

package/dist/{core-W5f4Rjt0.js → core-B8sLve3z.js}

@@ -1,10 +1,10 @@
-import { M as memoryCustomRoleSource } from "./src-nYNBfmgq.js";
+import { A as memoryCustomRoleSource } from "./src-Brzq_0in.js";
 import { c as listPermissions } from "./permission-registry-B8tYxPIt.js";
 import { d as scopeList } from "./scopes-BSdYaGHs.js";
-import { y as membershipsClaim } from "./evaluate-CsjXeLRo.js";
+import { y as membershipsClaim } from "./evaluate-Czbj7thS.js";
 import { n as parseSnapshot } from "./snapshot-DN_8J27z.js";
 import { n as fromSnapshot } from "./from-snapshot-DMlSSo9b.js";
-import { t as getPermDock } from "./permdock-DdzMv5-F.js";
+import { t as getPermDock } from "./permdock-D-_WrdKu.js";
 import "./budget-BBCPDOGP.js";
 import { c as quoteSqlTable, n as defaultSqlCommand, o as quoteSqlIdent, t as SQL_IDENT } from "./sql-0WjxIp9g.js";
 //#region src/testing/policy-matrix.ts

package/dist/{core-0iYZ5HUx.d.ts → core-D87h2kpR.d.ts}

@@ -1,6 +1,6 @@
-import { E as Policy, dr as CustomRole, gr as Membership, qn as Decision } from "./policy-types-IRJVABmm.js";
+import { E as Policy, dr as CustomRole, gr as Membership, qn as Decision } from "./policy-types-D-GwfQTc.js";
 import { u as Permission } from "./permission-types-CAY-GU7e.js";
-import { f as WhereResult, o as PermDockOptions } from "./permdock-DUWZEOLR.js";
+import { f as WhereResult, o as PermDockOptions } from "./permdock-ffY4CMd9.js";
 //#region src/testing/policy-matrix.d.ts
 type MatrixOutcome = "granted" | "denied" | "approval-required";
 type MatrixCell = MatrixOutcome | {

package/dist/{create-jCPwPWXf.js → create-3A7J9KRR.js}

@@ -3,14 +3,14 @@ import { n as freezeDeep } from "./freeze-jjan0lCv.js";
 import { n as problemDetails } from "./problem-details-CLDgX1KV.js";
 import { c as listPermissions } from "./permission-registry-B8tYxPIt.js";
 import { n as resourceRef } from "./resource-ref-CaS9yVPi.js";
-import { i as challengeScope, l as withApp } from "./permdock-DdzMv5-F.js";
+import { i as challengeScope, l as withApp } from "./permdock-D-_WrdKu.js";
 import { r as hasCredentials } from "./http-DKLXrFGk.js";
 import { a as decisionResponse, c as problemFromDecision, d as unauthenticatedProblem, s as notFoundProblem, t as ANONYMOUS } from "./problem-BVLHFK33.js";
-import { n as resolveOrNull } from "./build-instance-lye7oEqf.js";
+import { n as resolveOrNull } from "./build-instance-BFMFQdE_.js";
 import { t as LOAD_FAILED } from "./decision-CaG5_eNJ.js";
-import { l as InvalidSignatureError, n as applyApprovalResume, o as evaluationsHandler } from "./evaluations-DG40eSJa.js";
+import { l as InvalidSignatureError, n as applyApprovalResume, o as evaluationsHandler } from "./evaluations-h3KoJAPa.js";
 import { n as tenantScope, t as actorFrom } from "./adapter-context-OHikyRqV.js";
-import { n as requestContext, t as buildReportingInstance } from "./request-context-Ch052blg.js";
+import { n as requestContext, t as buildReportingInstance } from "./request-context-DM6_jY1n.js";
 //#region src/server/kernel-problems.ts
 const NOT_DELEGATED = freezeDeep({
 	outcome: "denied",

package/dist/{create-DrHUmKvG.d.ts → create-BrQXL-Wt.d.ts}

@@ -1,10 +1,10 @@
-import { E as Policy, Jn as Denial, Kt as Instant, M as PolicyVocabulary, _r as Principal, _t as TokenVerifier, an as AuthEvent, gt as TokenSigner, qn as Decision } from "./policy-types-IRJVABmm.js";
+import { E as Policy, Jn as Denial, Kt as Instant, M as PolicyVocabulary, _r as Principal, _t as TokenVerifier, an as AuthEvent, gt as TokenSigner, qn as Decision } from "./policy-types-D-GwfQTc.js";
 import { u as Permission } from "./permission-types-CAY-GU7e.js";
-import { _ as PrincipalSource, a as PermDock, n as DecideOptions, o as PermDockOptions } from "./permdock-DUWZEOLR.js";
-import { m as ApprovalStore } from "./types-BvBbkAu1.js";
-import { a as AutomationSource } from "./automation-DCWuVKtd.js";
-import { n as ApprovalWaiter } from "./waiter-C2cXXLFZ.js";
-import { c as RunResource, i as RunBinding, r as RunAutomation } from "./run-ticket-C6lXvHM_.js";
+import { _ as PrincipalSource, a as PermDock, n as DecideOptions, o as PermDockOptions } from "./permdock-ffY4CMd9.js";
+import { m as ApprovalStore } from "./types-CqcsNCaN.js";
+import { a as AutomationSource } from "./automation-Bfa_wD1h.js";
+import { n as ApprovalWaiter } from "./waiter-NK_UuZbb.js";
+import { c as RunResource, i as RunBinding, r as RunAutomation } from "./run-ticket-DPaD27_r.js";
 //#region src/workflow/create.d.ts
 type WorkflowPermDockOptions = PermDockOptions & {
   /** Signs the run tickets `start` mints. */

package/dist/{create-bzQlBzG4.d.ts → create-BzwjZuRS.d.ts}

@@ -1,13 +1,13 @@
-import { E as Policy, M as PolicyVocabulary, _r as Principal, pr as Delegation, qn as Decision, yr as Subject } from "./policy-types-IRJVABmm.js";
+import { E as Policy, M as PolicyVocabulary, _r as Principal, pr as Delegation, qn as Decision, yr as Subject } from "./policy-types-D-GwfQTc.js";
 import { u as Permission } from "./permission-types-CAY-GU7e.js";
 import { t as Operation } from "./operations-Ci_rT6Uo.js";
-import { a as PermDock } from "./permdock-DUWZEOLR.js";
-import { m as ApprovalStore } from "./types-BvBbkAu1.js";
-import { t as InstanceOptions } from "./instance-options-BOCRxEFb.js";
+import { a as PermDock } from "./permdock-ffY4CMd9.js";
+import { m as ApprovalStore } from "./types-CqcsNCaN.js";
+import { t as InstanceOptions } from "./instance-options-2sFGSdsf.js";
 import { t as RequestContext } from "./request-context-C2_1lchh.js";
-import { n as PermDockWrap } from "./wrap-DpZAbxuD.js";
-import { o as OtelWrap } from "./types-Sj1U8HMm.js";
-import { t as DeniedText } from "./denied-text-DyzWwxEB.js";
+import { n as PermDockWrap } from "./wrap-BHGA-SMM.js";
+import { o as OtelWrap } from "./types-DGf_cpKF.js";
+import { t as DeniedText } from "./denied-text-DlIxt8fh.js";
 //#region src/agent/step-up.d.ts
 /**
  * What the user can do to lift a denial: authenticate again with the `acr` and

package/dist/{create-gqtDb1nU.js → create-C-tm3KIF.js}

@@ -1,10 +1,10 @@
 import { t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-jjan0lCv.js";
 import { o as deniedFor } from "./where-scope-BKrqUDVk.js";
-import { l as withApp } from "./permdock-DdzMv5-F.js";
+import { l as withApp } from "./permdock-D-_WrdKu.js";
 import { t as composeWraps } from "./wrap-C5PWzgkq.js";
-import { r as instanceOptions } from "./build-instance-lye7oEqf.js";
-import { n as createAgentKernel } from "./kernel-CDDU93dI.js";
+import { r as instanceOptions } from "./build-instance-BFMFQdE_.js";
+import { n as createAgentKernel } from "./kernel-30Z2zM_d.js";
 //#region src/agent/create.ts
 function modelRow(modelId) {
 	return { id: modelId };

package/dist/{create-DNN3OtsO.d.ts → create-CtoT1lIQ.d.ts}

@@ -1,9 +1,9 @@
-import { $n as GrantedDecision, E as Policy, Kn as ApprovalRequiredDecision, M as PolicyVocabulary, Zn as DeniedDecision, _r as Principal, yr as Subject } from "./policy-types-IRJVABmm.js";
+import { $n as GrantedDecision, E as Policy, Kn as ApprovalRequiredDecision, M as PolicyVocabulary, Zn as DeniedDecision, _r as Principal, yr as Subject } from "./policy-types-D-GwfQTc.js";
 import { t as Operation } from "./operations-Ci_rT6Uo.js";
-import { _ as PrincipalSource, a as PermDock, o as PermDockOptions } from "./permdock-DUWZEOLR.js";
-import { m as ApprovalStore, p as ApprovalStatus } from "./types-BvBbkAu1.js";
+import { _ as PrincipalSource, a as PermDock, o as PermDockOptions } from "./permdock-ffY4CMd9.js";
+import { m as ApprovalStore, p as ApprovalStatus } from "./types-CqcsNCaN.js";
 import { n as ApprovalErrorCode } from "./errors-CHwoRRpB.js";
-import { t as ApprovalPrompt } from "./approval-prompt-BSh-yxbH.js";
+import { t as ApprovalPrompt } from "./approval-prompt-Bg7gDSqd.js";
 //#region src/chat/subject.d.ts
 /**
  * The platform user behind a chat message or action. Fill it only from an event

package/dist/delivery/index.d.ts

@@ -1,5 +1,5 @@
-import { dn as DeliveryFailureCause, ln as DeliveryChannel, pn as EmailCategory } from "../policy-types-IRJVABmm.js";
-import { i as approvalUrlFor, n as ApprovalUrl, r as approvalPrompt, t as ApprovalPrompt } from "../approval-prompt-BSh-yxbH.js";
-import { _ as TransportOptions, a as DeliveryReport, c as DeliveryTransport, d as EmailTransport, f as EmailUnsubscribe, g as TransportMessages, h as TransportItem, i as DeliveryMessages, l as DeliveryTransports, m as Recipient, n as ChatTransport, o as DeliveryResult, p as OutgoingEmail, r as DeliverOptions, s as DeliveryTarget, t as ChatMessage, u as EmailMessage, v as WebhookMessage, y as WebhookTransport } from "../types-UfpcY575.js";
-import { C as audience, S as SubscriberEvent, _ as ParseConnectorResult, a as DeliveryPermDock, b as Audience, c as MemoryDelivery, d as memoryDeliveryTransport, f as CONNECTOR_SCHEMA, g as ConnectorKind, h as ConnectorIssue, i as isDeliveryTarget, l as MemoryDeliveryTransport, m as Connector, n as webhookTransport, o as DeliveryPermDockOptions, p as CONNECTOR_KINDS, r as isAddrSpec, s as createPermDock, t as WebhookTransportOptions, u as MemoryDeliveryTransportOptions, v as SiemDestination, w as subscribersFor, x as AudienceOptions, y as parseConnector } from "../index-DFwUOkvt.js";
+import { dn as DeliveryFailureCause, ln as DeliveryChannel, pn as EmailCategory } from "../policy-types-D-GwfQTc.js";
+import { i as approvalUrlFor, n as ApprovalUrl, r as approvalPrompt, t as ApprovalPrompt } from "../approval-prompt-Bg7gDSqd.js";
+import { _ as TransportOptions, a as DeliveryReport, c as DeliveryTransport, d as EmailTransport, f as EmailUnsubscribe, g as TransportMessages, h as TransportItem, i as DeliveryMessages, l as DeliveryTransports, m as Recipient, n as ChatTransport, o as DeliveryResult, p as OutgoingEmail, r as DeliverOptions, s as DeliveryTarget, t as ChatMessage, u as EmailMessage, v as WebhookMessage, y as WebhookTransport } from "../types-CCEeSCMB.js";
+import { C as audience, S as SubscriberEvent, _ as ParseConnectorResult, a as DeliveryPermDock, b as Audience, c as MemoryDelivery, d as memoryDeliveryTransport, f as CONNECTOR_SCHEMA, g as ConnectorKind, h as ConnectorIssue, i as isDeliveryTarget, l as MemoryDeliveryTransport, m as Connector, n as webhookTransport, o as DeliveryPermDockOptions, p as CONNECTOR_KINDS, r as isAddrSpec, s as createPermDock, t as WebhookTransportOptions, u as MemoryDeliveryTransportOptions, v as SiemDestination, w as subscribersFor, x as AudienceOptions, y as parseConnector } from "../index-CVGio3cH.js";
 export { type ApprovalPrompt, type ApprovalUrl, type Audience, type AudienceOptions, CONNECTOR_KINDS, CONNECTOR_SCHEMA, type ChatMessage, type ChatTransport, type Connector, type ConnectorIssue, type ConnectorKind, type DeliverOptions, type DeliveryChannel, type DeliveryFailureCause, type DeliveryMessages, type DeliveryPermDock, type DeliveryPermDockOptions, type DeliveryReport, type DeliveryResult, type DeliveryTarget, type DeliveryTransport, type DeliveryTransports, type EmailCategory, type EmailMessage, type EmailTransport, type EmailUnsubscribe, type MemoryDelivery, type MemoryDeliveryTransport, type MemoryDeliveryTransportOptions, type OutgoingEmail, type ParseConnectorResult, type Recipient, type SiemDestination, type SubscriberEvent, type TransportItem, type TransportMessages, type TransportOptions, type WebhookMessage, type WebhookTransport, type WebhookTransportOptions, approvalPrompt, approvalUrlFor, audience, createPermDock, isAddrSpec, isDeliveryTarget, memoryDeliveryTransport, parseConnector, subscribersFor, webhookTransport };

package/dist/delivery/index.js

@@ -1,5 +1,5 @@
 import { n as approvalUrlFor, t as approvalPrompt } from "../approval-prompt-B8hQY69x.js";
-import { n as subscribersFor, t as audience } from "../audience-jRO819i3.js";
+import { n as subscribersFor, t as audience } from "../audience-B4YR9UpV.js";
 import { t as CONNECTOR_SCHEMA } from "../connector-schema-CYLQNMYq.js";
 import { a as parseConnector, i as CONNECTOR_KINDS, n as createPermDock, r as memoryDeliveryTransport, t as webhookTransport } from "../delivery-BupfvJIV.js";
 import { i as isDeliveryTarget, n as isAddrSpec } from "../target-qdEAnnhU.js";

package/dist/{denied-text-DyzWwxEB.d.ts → denied-text-DlIxt8fh.d.ts}

@@ -1,4 +1,4 @@
-import { qn as Decision } from "./policy-types-IRJVABmm.js";
+import { qn as Decision } from "./policy-types-D-GwfQTc.js";
 import { u as Permission } from "./permission-types-CAY-GU7e.js";
 //#region src/agent/denied-text.d.ts
 /**

package/dist/{describe-nalX_HHE.d.ts → describe-BKtC_8PG.d.ts}

@@ -1,4 +1,4 @@
-import { Xn as DenialReason, Zn as DeniedDecision, qn as Decision } from "./policy-types-IRJVABmm.js";
+import { Xn as DenialReason, Zn as DeniedDecision, qn as Decision } from "./policy-types-D-GwfQTc.js";
 import { u as Permission } from "./permission-types-CAY-GU7e.js";
 //#region src/core/describe.d.ts
 type DecisionDescription = {

package/dist/{describe-CogP1loh.js → describe-BZAlPHxT.js}

@@ -1,4 +1,4 @@
-import { a as flattenApprovers } from "./approvers-CNtl4Vc5.js";
+import { a as flattenApprovers } from "./approvers-BaNwKYgd.js";
 import { r as requiredPlans } from "./problem-details-CLDgX1KV.js";
 //#region src/core/describe.ts
 const TENANT_REASONS = /* @__PURE__ */ new Set([