permdock 0.2.0 → 0.3.0

package/dist/a2a/index.d.ts

@@ -1,8 +1,8 @@
-import { C as Policy, Nr as Principal, Tr as AuthorizationDetail } from "../policy-CFZAr_Al.js";
+import { C as Policy, Nr as Principal, Tr as AuthorizationDetail } from "../policy-IB6yxpC3.js";
 import { f as Permission } from "../permissions-DttnqqxC.js";
-import { f as ApprovalStore } from "../types-vKyAMtcX.js";
-import { a as ProblemDetails } from "../errors-DAqevpNk.js";
-import { t as InstanceOptions } from "../instance-options-BK_rNOSC.js";
+import { f as ApprovalStore } from "../types-aqOHTHcp.js";
+import { a as ProblemDetails } from "../errors-DPdqI50v.js";
+import { t as InstanceOptions } from "../instance-options-jARdwfPN.js";
 //#region src/a2a/types.d.ts
 type A2aAuth = {
   readonly clientId?: string;

package/dist/a2a/index.js

@@ -2,12 +2,12 @@ import { t as compact } from "../compact-y6vfu2_f.js";
 import { n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "../errors-Cz5zn0mW.js";
 import { t as canonicalJson } from "../canonical-json-DemiK4Vp.js";
 import { t as bytesToBase64Url } from "../sha256-BO0swRXL.js";
-import { i as scopesReaching, r as challengeScope } from "../permdock-CzqXjCpU.js";
+import { i as scopesReaching, r as challengeScope } from "../permdock-CbgvLnuo.js";
 import { n as resourceRef } from "../resource-ref-CaS9yVPi.js";
 import { t as mayUse } from "../may-use-DndQ5tQ-.js";
 import { d as wwwAuthenticate, n as bearerChallenge } from "../problem-B43ztKIm.js";
 import { t as instanceOptions } from "../instance-options-Dhhcnm3y.js";
-import { n as createAgentKernel } from "../kernel-GSQnMz3O.js";
+import { n as createAgentKernel } from "../kernel-_RRHmnMY.js";
 //#region src/a2a/create.ts
 function firstScheme(options) {
 	return Object.keys(options.securitySchemes)[0];

package/dist/ai-sdk/index.d.ts

@@ -1,7 +1,7 @@
-import { C as Policy, Nr as Principal, kr as Delegation } from "../policy-CFZAr_Al.js";
+import { C as Policy, Nr as Principal, kr as Delegation } from "../policy-IB6yxpC3.js";
 import { f as Permission } from "../permissions-DttnqqxC.js";
-import { f as ApprovalStore } from "../types-vKyAMtcX.js";
-import { t as InstanceOptions } from "../instance-options-BK_rNOSC.js";
+import { f as ApprovalStore } from "../types-aqOHTHcp.js";
+import { t as InstanceOptions } from "../instance-options-jARdwfPN.js";
 import { t as ToolMap } from "../types-Bvc4oWT6.js";
 //#region src/ai-sdk/create.d.ts
 type AiSdkContext = {

package/dist/ai-sdk/index.js

@@ -1,7 +1,7 @@
 import { t as compact } from "../compact-y6vfu2_f.js";
 import { n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "../errors-Cz5zn0mW.js";
 import { t as instanceOptions } from "../instance-options-Dhhcnm3y.js";
-import { n as createAgentKernel, t as approvalTokenOf } from "../kernel-GSQnMz3O.js";
+import { n as createAgentKernel, t as approvalTokenOf } from "../kernel-_RRHmnMY.js";
 //#region src/ai-sdk/create.ts
 const APPROVAL_STATUSES = /* @__PURE__ */ new Set([
 	"approved",

package/dist/approvals/index.d.ts

@@ -1,3 +1,3 @@
-import { _ as approverRelationKey, a as ApprovalListFilter, c as ApprovalRequest, d as ApprovalStatus, f as ApprovalStore, g as approvalQuorum, h as DEFAULT_APPROVAL_TTL_MS, i as ApprovalInspectResult, l as ApprovalResumeFailure, m as ApprovalVerdict, n as ApprovalApprovers, o as ApprovalListQuery, p as ApprovalSubjectSummary, r as ApprovalCancelMeta, s as ApprovalPage, t as APPROVAL_HEADER, u as ApprovalSignature, v as escalationOpenAt } from "../types-vKyAMtcX.js";
-import { C as ApproverRelationsOptions, D as ApprovalError, E as approvalsHandler, O as ApprovalErrorCode, S as vouchApproval, T as ApprovalsHandlerOptions, _ as resolveApproval, a as approverPermissions, b as storedApprovalToken, c as decodeApprovalCursor, d as pageApprovals, f as cancelApprovals, g as requestApproval, h as readApprovalHeader, i as memoryApprovalStore, k as isApprovalError, l as encodeApprovalCursor, m as inspectApproval, n as applyApprovalVerdict, o as ApprovalCursorPosition, p as consumeApproval, r as assertApprover, s as approvalPageSize, t as MemoryApprovalStore, u as listAllApprovals, v as resumeDecision, w as approverRelations, x as summariseSubject, y as resumeFromHeader } from "../index-D6_cSa1z.js";
+import { _ as approverRelationKey, a as ApprovalListFilter, c as ApprovalRequest, d as ApprovalStatus, f as ApprovalStore, g as approvalQuorum, h as DEFAULT_APPROVAL_TTL_MS, i as ApprovalInspectResult, l as ApprovalResumeFailure, m as ApprovalVerdict, n as ApprovalApprovers, o as ApprovalListQuery, p as ApprovalSubjectSummary, r as ApprovalCancelMeta, s as ApprovalPage, t as APPROVAL_HEADER, u as ApprovalSignature, v as escalationOpenAt } from "../types-aqOHTHcp.js";
+import { C as ApproverRelationsOptions, D as ApprovalError, E as approvalsHandler, O as ApprovalErrorCode, S as vouchApproval, T as ApprovalsHandlerOptions, _ as resolveApproval, a as approverPermissions, b as storedApprovalToken, c as decodeApprovalCursor, d as pageApprovals, f as cancelApprovals, g as requestApproval, h as readApprovalHeader, i as memoryApprovalStore, k as isApprovalError, l as encodeApprovalCursor, m as inspectApproval, n as applyApprovalVerdict, o as ApprovalCursorPosition, p as consumeApproval, r as assertApprover, s as approvalPageSize, t as MemoryApprovalStore, u as listAllApprovals, v as resumeDecision, w as approverRelations, x as summariseSubject, y as resumeFromHeader } from "../index-C7Tw7MaW.js";
 export { APPROVAL_HEADER, type ApprovalApprovers, type ApprovalCancelMeta, type ApprovalCursorPosition, ApprovalError, type ApprovalErrorCode, type ApprovalInspectResult, type ApprovalListFilter, type ApprovalListQuery, type ApprovalPage, type ApprovalRequest, type ApprovalResumeFailure, type ApprovalSignature, type ApprovalStatus, type ApprovalStore, type ApprovalSubjectSummary, type ApprovalVerdict, type ApprovalsHandlerOptions, type ApproverRelationsOptions, DEFAULT_APPROVAL_TTL_MS, type MemoryApprovalStore, applyApprovalVerdict, approvalPageSize, approvalQuorum, approvalsHandler, approverPermissions, approverRelationKey, approverRelations, assertApprover, cancelApprovals, consumeApproval, decodeApprovalCursor, encodeApprovalCursor, escalationOpenAt, inspectApproval, isApprovalError, listAllApprovals, memoryApprovalStore, pageApprovals, readApprovalHeader, requestApproval, resolveApproval, resumeDecision, resumeFromHeader, storedApprovalToken, summariseSubject, vouchApproval };

package/dist/{arazzo-cmvX2jDe.js → arazzo-CKwwqFWz.js}

@@ -1,4 +1,4 @@
-import { a as listArg, i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-DWOrSQic.js";
+import { a as listArg, i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-DSxCqG9A.js";
 import { defineCommand } from "citty";
 //#region src/cli/commands/arazzo.ts
 function arazzo(ctx) {

package/dist/authzen/index.d.ts

@@ -1,6 +1,6 @@
-import { C as Policy, Nr as Principal } from "../policy-CFZAr_Al.js";
-import { f as ApprovalStore } from "../types-vKyAMtcX.js";
-import { t as InstanceOptions } from "../instance-options-BK_rNOSC.js";
+import { C as Policy, Nr as Principal } from "../policy-IB6yxpC3.js";
+import { f as ApprovalStore } from "../types-aqOHTHcp.js";
+import { t as InstanceOptions } from "../instance-options-jARdwfPN.js";
 //#region src/authzen/types.d.ts
 type AuthzenResourceAdapter = {
   readonly load?: (id: string) => unknown;

package/dist/authzen/index.js

@@ -1,7 +1,7 @@
 import { t as compact } from "../compact-y6vfu2_f.js";
 import { E as ownGet, _ as listPermissions, c as getResource } from "../permissions-DVoF6dMt.js";
 import { t as PROBLEM_BASE } from "../validation-error-CnjZ4t92.js";
-import { t as createPermDock$1 } from "../permdock-CzqXjCpU.js";
+import { t as createPermDock$1 } from "../permdock-CbgvLnuo.js";
 import { n as resourceRef } from "../resource-ref-CaS9yVPi.js";
 import { n as hasCredentials } from "../http-SO7qGttf.js";
 import { i as methodNotAllowed, l as unauthenticatedProblem, s as problemResponse, t as batchTooLarge, u as validationProblem } from "../problem-B43ztKIm.js";

package/dist/better-auth/index.d.ts

@@ -1,4 +1,4 @@
-import { Nr as Principal, Pr as Subject, at as DecisionSink, k as RoleBinding, xt as RoleSource } from "../policy-CFZAr_Al.js";
+import { Nr as Principal, Pr as Subject, at as DecisionSink, k as RoleBinding, xt as RoleSource } from "../policy-IB6yxpC3.js";
 import { m as PermissionTree } from "../permissions-DttnqqxC.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/better-auth/types.d.ts

package/dist/better-supabase/index.d.ts

@@ -1,6 +1,6 @@
-import { $t as CredentialPrincipal, Pr as Subject, ln as PermDock, nt as CredentialVerifier } from "../policy-CFZAr_Al.js";
+import { $t as CredentialPrincipal, C as Policy, Pr as Subject, ln as PermDock, nt as CredentialVerifier } from "../policy-IB6yxpC3.js";
 import { f as Permission, m as PermissionTree } from "../permissions-DttnqqxC.js";
-import { g as SupabaseSubjectOptions, m as SupabaseSessionLike, u as SupabasePrincipal } from "../types-yF5LmQVD.js";
+import { g as SupabaseSubjectOptions, m as SupabaseSessionLike, u as SupabasePrincipal } from "../types-C97IskBw.js";
 import { AuthorizationProvider } from "better-supabase/config";
 import { AccessTopicPolicy } from "better-supabase/realtime";
 import { AccessBucketPolicy } from "better-supabase/storage";
@@ -42,16 +42,32 @@ type AuthorizationProviderOptions = {
 export declare function authorizationProvider(options: AuthorizationProviderOptions): AuthorizationProvider;
 //#endregion
 //#region src/better-supabase/policies.d.ts
-type AccessPolicyOptions = {
-  /** `permdock.manifest.json`, parsed or as JSON text: it names the helpers' schema and the scopes. */
-  readonly manifest: unknown;
-  /** `permissions.catalog.json`: only keys it marks `rowConditions: false` are accepted. */
-  readonly catalog: unknown;
-  /** A scope in the manifest's `rls.scopes`, or `platform` for permissions granted globally. */
+type AccessScope = {
+  /** A scope in the policy's scopes (or the manifest's `rls.scopes`), or `platform` for permissions granted globally. */
   readonly scope: string;
   /** 1-based path or topic segment holding the scope id; better-supabase's default is the `{organizationId}` segment. */
   readonly segment?: number;
 };
+/**
+ * Either the policy the app already defines, or the two files the CLI writes.
+ * With `policy` nothing is read at runtime: the scopes, the row conditions and
+ * the scopes a permission is granted at come from the definitions.
+ */
+type AccessPolicyOptions = AccessScope & ({
+  /** `permdock.manifest.json`, parsed or as JSON text: it names the helpers' schema and the scopes. */
+  readonly manifest: unknown;
+  /** `permissions.catalog.json`: only keys it marks `rowConditions: false` are accepted. */
+  readonly catalog: unknown;
+  readonly policy?: undefined;
+  readonly schema?: undefined;
+} | {
+  /** The `definePolicy` result: only keys with no row condition in it are accepted. */
+  readonly policy: Policy;
+  /** The schema `rls generate` put the helpers in (`rls.schema`). Default `permdock`. */
+  readonly schema?: string;
+  readonly manifest?: undefined;
+  readonly catalog?: undefined;
+});
 type BucketAccess = {
   /** Downloads, signed URLs, renders and metadata reads. */
   readonly read: Permission;
@@ -69,8 +85,9 @@ type TopicAccess = {
 /**
  * A better-supabase bucket `policy` that checks PermDock permissions with
  * the `rls generate` helpers at `scope`. The helpers check role and scope
- * only, so a permission the catalog doesn't mark `rowConditions: false`, or
- * doesn't grant at `scope`, throws.
+ * only, so a permission with row conditions (`rowConditions: true` in the
+ * catalog, or a conditioned grant in `policy`), or one not granted at
+ * `scope`, throws.
  */
 export declare function bucketPolicy(access: BucketAccess, options: AccessPolicyOptions): AccessBucketPolicy;
 /** As {@link bucketPolicy}, for a better-supabase Realtime topic. */

package/dist/better-supabase/index.js

@@ -1,9 +1,12 @@
 import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
 import { _ as listPermissions, p as isPermission } from "../permissions-DVoF6dMt.js";
+import { d as scopeList } from "../scopes-CVdPrWN-.js";
 import { t as anonymousSubject } from "../subject-C6dLxqHU.js";
 import { t as mayUse } from "../may-use-DndQ5tQ-.js";
 import { o as parseCredential, r as credentialSubject } from "../credential-8P81ff4u.js";
+import { t as policyRowConditionKeys } from "../row-conditions-h2HythXQ.js";
 import { i as quoteSqlLiteral, o as sqlIdent } from "../sql-xdg5f4Fi.js";
+import "../sources-4p0-4xQm.js";
 import { o as subjectFromSupabaseSession, t as parseSupabaseManifest } from "../manifest-iaoBXHKc.js";
 import { t as parseCatalog } from "../parse-BuyjxhZV.js";
 import { AsyncResult, dbError } from "better-supabase";
@@ -314,25 +317,49 @@ function authorizationProvider(options) {
 //#region src/better-supabase/policies.ts
 /** PermDock splits a key with row conditions into `key#1`, `key#2`, ... in the policies it generates. */
 const SPLIT_KEY = /#\d+$/u;
-function checkedKey(where, permission, catalog, scope) {
+function checkedKey(where, permission, facts, scope) {
 	const key = permission.key;
 	if (SPLIT_KEY.test(key)) throw new TypeError(`PermDock: ${where} "${key}" is one part of a permission split by row condition. Use the policies \`permdock rls generate\` writes for it.`);
-	const entry = catalog.permissions.find((candidate) => candidate.key === key);
-	if (!entry) throw new TypeError(`PermDock: ${where} "${key}" is not in permissions.catalog.json. Run \`permdock catalog\`.`);
+	const entry = facts(key);
+	if (!entry.known) throw new TypeError(`PermDock: ${where} "${key}" is not in permissions.catalog.json. Run \`permdock catalog\`.`);
 	if (entry.rowConditions) throw new TypeError(`PermDock: ${where} "${key}" has row conditions (rowConditions: true), which the SQL helpers don't check, so the policy would grant every object in the scope. Use the policies \`permdock rls generate\` writes for it.`);
 	const grantScope = scope === "platform" ? "global" : scope;
-	const scopes = (catalog.grants ?? []).flatMap((grant) => grant.permission === key && typeof grant.scope === "string" ? [grant.scope] : []);
+	const scopes = entry.grantScopes;
 	if (scopes.length > 0 && !scopes.includes(grantScope)) throw new TypeError(`PermDock: ${where} "${key}" is granted at ${[...new Set(scopes)].join(", ")}, not at ${grantScope}. Check it at one of those scopes.`);
 	return key;
 }
 function target(options) {
-	const manifest = parseSupabaseManifest(options.manifest);
-	const catalog = parseCatalog(options.catalog);
-	const names = manifest.rls.scopes.map((scope) => scope.name);
-	if (options.scope !== "platform" && !names.includes(options.scope)) throw new TypeError(`PermDock: scope "${options.scope}" is not in the manifest's rls.scopes (${names.join(", ")}) and is not "platform".`);
-	const schema = sqlIdent(manifest.rls.schema);
+	const policy = options.policy;
+	let names;
+	let schemaName;
+	let facts;
+	if (policy === void 0) {
+		const manifest = parseSupabaseManifest(options.manifest);
+		const catalog = parseCatalog(options.catalog);
+		names = manifest.rls.scopes.map((scope) => scope.name);
+		schemaName = manifest.rls.schema;
+		facts = (key) => {
+			const entry = catalog.permissions.find((candidate) => candidate.key === key);
+			return {
+				known: entry !== void 0,
+				rowConditions: entry?.rowConditions === true,
+				grantScopes: (catalog.grants ?? []).flatMap((grant) => grant.permission === key && typeof grant.scope === "string" ? [grant.scope] : [])
+			};
+		};
+	} else {
+		names = scopeList(policy.scopes).map((scope) => scope.name);
+		schemaName = options.schema ?? "permdock";
+		const conditioned = policyRowConditionKeys(policy);
+		facts = (key) => ({
+			known: true,
+			rowConditions: conditioned.has(key),
+			grantScopes: policy.grants.flatMap((grant) => grant.hosted === void 0 && grant.permission.key === key && typeof grant.scope === "string" ? [grant.scope] : [])
+		});
+	}
+	if (options.scope !== "platform" && !names.includes(options.scope)) throw new TypeError(`PermDock: scope "${options.scope}" is not in the ${policy === void 0 ? "manifest's rls.scopes" : "policy's scopes"} (${names.join(", ")}) and is not "platform".`);
+	const schema = sqlIdent(schemaName);
 	return {
-		catalog,
+		facts,
 		sql: {
 			idsWith: `${schema}.permitted_{scope}_ids_by_permission({permission})`,
 			isPlatform: `${schema}.permdock_has_permission({permission})`
@@ -342,12 +369,13 @@ function target(options) {
 /**
 * A better-supabase bucket `policy` that checks PermDock permissions with
 * the `rls generate` helpers at `scope`. The helpers check role and scope
-* only, so a permission the catalog doesn't mark `rowConditions: false`, or
-* doesn't grant at `scope`, throws.
+* only, so a permission with row conditions (`rowConditions: true` in the
+* catalog, or a conditioned grant in `policy`), or one not granted at
+* `scope`, throws.
 */
 function bucketPolicy(access, options) {
-	const { catalog, sql } = target(options);
-	const key = (name, permission) => checkedKey(`bucket access.${name}`, permission, catalog, options.scope);
+	const { facts, sql } = target(options);
+	const key = (name, permission) => checkedKey(`bucket access.${name}`, permission, facts, options.scope);
 	return freezeDeep({
 		access: {
 			read: key("read", access.read),
@@ -362,8 +390,8 @@ function bucketPolicy(access, options) {
 }
 /** As {@link bucketPolicy}, for a better-supabase Realtime topic. */
 function topicPolicy(access, options) {
-	const { catalog, sql } = target(options);
-	const key = (name, permission) => checkedKey(`topic ${name}`, permission, catalog, options.scope);
+	const { facts, sql } = target(options);
+	const key = (name, permission) => checkedKey(`topic ${name}`, permission, facts, options.scope);
 	return freezeDeep({
 		receive: key("receive", access.receive),
 		...access.send ? { send: key("send", access.send) } : {},

package/dist/{bind-CVy3Espv.d.ts → bind-C_ob3LKa.d.ts}

@@ -1,8 +1,8 @@
-import { f as ApprovalStore } from "./types-vKyAMtcX.js";
-import { t as InstanceOptions } from "./instance-options-BK_rNOSC.js";
-import { r as PdpFactory } from "./types-BVyImy5I.js";
-import { o as OtelWrap } from "./types-vNSDF7Dq.js";
-import { T as TenantOption, b as WebBotAuthVerifier } from "./create-BWyx3jua.js";
+import { f as ApprovalStore } from "./types-aqOHTHcp.js";
+import { t as InstanceOptions } from "./instance-options-jARdwfPN.js";
+import { r as PdpFactory } from "./types-DxiCGmmd.js";
+import { o as OtelWrap } from "./types-QCuYJh4q.js";
+import { T as TenantOption, b as WebBotAuthVerifier } from "./create-B1d519XK.js";
 //#region src/server/bind.d.ts
 /** The options of every framework adapter; `TContext` is what its callbacks receive. */
 type ServerAdapterOptions<TContext, TUser = unknown> = InstanceOptions & ServerAdapterServices & {

package/dist/{bind-VnYn2HKq.js → bind-CuzGytRf.js}

@@ -2,7 +2,7 @@ import { t as compact } from "./compact-y6vfu2_f.js";
 import { o as invalidSignatureResponse } from "./evaluations-tz6D9A2G.js";
 import { t as instanceOptions } from "./instance-options-Dhhcnm3y.js";
 import { n as tenantScope } from "./adapter-context-mlWsVGGg.js";
-import { n as createServerKernel } from "./create-CPhDL6qx.js";
+import { n as createServerKernel } from "./create-CMwIl-w2.js";
 //#region src/server/bind.ts
 /** The server kernel with the subject and actor callbacks reading the context `contextOf` maps a `Request` to. */
 function adapterKernel(policy, options, adapter, contextOf) {

package/dist/{capability-Dq43tT1u.d.ts → capability-2kYTMWDv.d.ts}

@@ -1,4 +1,4 @@
-import { Nr as Principal, Pr as Subject, Pt as TokenSigner } from "./policy-CFZAr_Al.js";
+import { Nr as Principal, Pr as Subject, Pt as TokenSigner } from "./policy-IB6yxpC3.js";
 import { f as Permission, m as PermissionTree } from "./permissions-DttnqqxC.js";
 //#region src/core/capability.d.ts
 /**

package/dist/catalog-CRW5Mx_B.js

@@ -0,0 +1,2 @@
+import { t as runCatalog } from "./catalog-DWF5cYqB.js";
+export { runCatalog };

package/dist/{catalog-z8q6bi_r.js → catalog-DWF5cYqB.js}

@@ -1,7 +1,7 @@
-import { a as formatCatalogMarkdown, i as formatCatalogJson, r as catalogSchemaDocument, t as buildCatalog } from "./catalog-doc-Dsc9y7sd.js";
+import { a as formatCatalogMarkdown, i as formatCatalogJson, r as catalogSchemaDocument, t as buildCatalog } from "./catalog-doc-DdGm82XT.js";
 import { r as listSourceFiles, t as defaultSrcPath } from "./files-DWUN9PzI.js";
 import { a as loadModule, i as loadConfiguredPolicy, o as pickNamed, r as leavesOf, t as asPermissionTree } from "./load-DhWEB9P1.js";
-import { i as scanSources, r as runCollect } from "./collect-DDDv_ESs.js";
+import { i as scanSources, r as runCollect } from "./collect-DSTE3ml9.js";
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 //#region src/cli/catalog.ts

package/dist/{catalog-h2tlKFkq.js → catalog-dFZdWCGN.js}

@@ -1,4 +1,4 @@
-import { a as listArg, i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-DWOrSQic.js";
+import { a as listArg, i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-DSxCqG9A.js";
 import { defineCommand } from "citty";
 //#region src/cli/commands/catalog.ts
 function catalog(ctx) {
@@ -31,7 +31,7 @@ function catalog(ctx) {
 			}
 		},
 		async run({ args: parsed, rawArgs }) {
-			const result = await (await import("./catalog-BjZSovXQ.js")).runCatalog({
+			const result = await (await import("./catalog-CRW5Mx_B.js")).runCatalog({
 				cwd: ctx.cwd,
 				config: ctx.config,
 				format: parsed.format,

package/dist/{catalog-doc-Dsc9y7sd.js → catalog-doc-DdGm82XT.js}

@@ -1,35 +1,12 @@
 import { _ as listPermissions, a as formerKeys, c as getResource } from "./permissions-DVoF6dMt.js";
-import { t as catalogFingerprint } from "./src-CSbUiozF.js";
+import { t as catalogFingerprint } from "./src-BDwEZWrZ.js";
 import { S as findRole } from "./grantee-Cv5Sogfv.js";
 import { t as canonicalJson } from "./canonical-json-DemiK4Vp.js";
 import { t as byCodePoint } from "./compare-pfyVnBjE.js";
 import { t as catalogSchema } from "./schema-D3MnDMxa.js";
+import { t as policyRowConditionKeys } from "./row-conditions-h2HythXQ.js";
 import { s as generatorBanner, t as CATALOG_SCHEMA } from "./version-BvacVTZR.js";
 //#region src/cli/catalog-doc.ts
-const ROW_GRANTEES = /* @__PURE__ */ new Set([
-	"relation",
-	"plan",
-	"actor",
-	"assurance",
-	"inherit"
-]);
-/**
-* Whether a grant depends on more than the role and the scope: a row or body
-* condition, a closure, a field list, a purpose, a break-glass override, a
-* validity window, a `requires`, or a relation, plan, actor or assurance grantee. The SQL helpers
-* (`permdock_has`, `permitted_<scope>_ids`) check only role and scope, so a
-* policy that calls them for such a permission would widen access.
-*/
-function grantHasRowConditions(grant) {
-	const grantees = Array.isArray(grant.to) ? grant.to : [grant.to];
-	return grant.where !== void 0 || grant.check !== void 0 || grant.closure !== void 0 || !grant.portable || grant.fields !== void 0 || grant.purpose !== void 0 || grant.breakGlass !== void 0 || grant.validity !== void 0 || grant.requires !== void 0 || grantees.some((grantee) => ROW_GRANTEES.has(grantee.kind));
-}
-/** Per permission key, whether any code grant for it has row conditions. */
-function policyRowConditionKeys(policy) {
-	const keys = /* @__PURE__ */ new Set();
-	for (const grant of [...policy.grants, ...policy.roles.flatMap((binding) => binding.grants)]) if (grant.hosted === void 0 && grantHasRowConditions(grant)) keys.add(grant.permission.key);
-	return keys;
-}
 function leafLevels(tree, leaf) {
 	if (leaf.kind !== "instance") return;
 	const names = Object.keys({ ...getResource(tree, leaf.resource)?.levels });
@@ -306,4 +283,4 @@ function catalogSchemaDocument() {
 	return catalogSchema;
 }
 //#endregion
-export { formatCatalogMarkdown as a, formatCatalogJson as i, catalogForCompare as n, jsonSchemaOf as o, catalogSchemaDocument as r, policyRowConditionKeys as s, buildCatalog as t };
+export { formatCatalogMarkdown as a, formatCatalogJson as i, catalogForCompare as n, jsonSchemaOf as o, catalogSchemaDocument as r, buildCatalog as t };

package/dist/claude-agent/index.d.ts

@@ -1,6 +1,6 @@
-import { C as Policy, D as PolicyVocabulary, Nr as Principal, kr as Delegation, ln as PermDock } from "../policy-CFZAr_Al.js";
-import { f as ApprovalStore } from "../types-vKyAMtcX.js";
-import { t as InstanceOptions } from "../instance-options-BK_rNOSC.js";
+import { C as Policy, D as PolicyVocabulary, Nr as Principal, kr as Delegation, ln as PermDock } from "../policy-IB6yxpC3.js";
+import { f as ApprovalStore } from "../types-aqOHTHcp.js";
+import { t as InstanceOptions } from "../instance-options-jARdwfPN.js";
 import { t as ToolMap } from "../types-Bvc4oWT6.js";
 //#region src/claude-agent/create.d.ts
 /** Structural `McpServerProvenance` from `@anthropic-ai/claude-agent-sdk`. */

package/dist/claude-agent/index.js

@@ -1,6 +1,6 @@
 import { t as compact } from "../compact-y6vfu2_f.js";
 import { t as instanceOptions } from "../instance-options-Dhhcnm3y.js";
-import { n as createAgentKernel } from "../kernel-GSQnMz3O.js";
+import { n as createAgentKernel } from "../kernel-_RRHmnMY.js";
 //#region src/claude-agent/create.ts
 const MCP_PREFIX = "mcp__";
 function asInput(input) {

package/dist/clerk/index.d.ts

@@ -1,6 +1,6 @@
-import { Nr as Principal, Pr as Subject, xt as RoleSource } from "../policy-CFZAr_Al.js";
+import { Nr as Principal, Pr as Subject, xt as RoleSource } from "../policy-IB6yxpC3.js";
 import { f as Permission } from "../permissions-DttnqqxC.js";
-import { s as RemotePdpCache } from "../types-BVyImy5I.js";
+import { s as RemotePdpCache } from "../types-DxiCGmmd.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/clerk/types.d.ts
 type ClerkPrincipal = Principal & {

package/dist/cli/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { t as run } from "../run-YXCJDNYk.js";
+import { t as run } from "../run-DKDbM4Du.js";
 import { n as streamHasColors } from "../style-CTm1AXDT.js";
 //#region src/cli/bin.ts
 const result = await run(process.argv.slice(2), {

package/dist/cli/index.d.ts

@@ -1,5 +1,5 @@
 import { a as CatalogDocument, c as CatalogResource, d as CatalogSupportAccess, f as CatalogUsage, l as CatalogRole, n as CatalogApproval, r as CatalogBreakGlass, s as CatalogPermission, t as CatalogActivation, u as CatalogScope } from "../types-Dnemwd77.js";
-import { _ as RunResult, c as RlsConfig, d as RlsMembershipTable, f as RlsMemberships, g as RlsTarget, h as RlsSuspension, i as PermDockConfig, l as RlsDialect, m as RlsSuspendedScope, n as CliIo, o as RlsActiveRow, p as RlsSuspendedMembership, r as CollectConfig, s as RlsApiKeys, t as CatalogConfig, u as RlsFunctionMapping } from "../types-BPxgszlT.js";
+import { _ as RunResult, c as RlsConfig, d as RlsMembershipTable, f as RlsMemberships, g as RlsTarget, h as RlsSuspension, i as PermDockConfig, l as RlsDialect, m as RlsSuspendedScope, n as CliIo, o as RlsActiveRow, p as RlsSuspendedMembership, r as CollectConfig, s as RlsApiKeys, t as CatalogConfig, u as RlsFunctionMapping } from "../types-DbjRN55U.js";
 //#region src/cli/catalog-path.d.ts
 /**
  * The absolute path `permdock collect` writes the catalog to: `collect.out`,

package/dist/cli/index.js

@@ -1,5 +1,5 @@
 import { t as catalogPath } from "../catalog-path-CnI0XTFK.js";
 import { t as defineConfig } from "../config-BJiM-xAm.js";
 import { o as parseGrantsMarker, s as parseHookMarker } from "../markers-B0hYLvMD.js";
-import { t as run } from "../run-YXCJDNYk.js";
+import { t as run } from "../run-DKDbM4Du.js";
 export { catalogPath, defineConfig, parseGrantsMarker, parseHookMarker, run };

package/dist/cloud/index.d.ts

@@ -1,7 +1,7 @@
-import { $ as AccessEvent, At as SnapshotSource, Ft as TokenVerifier, Nt as TokenFailureCause, at as DecisionSink, bn as PolicySource, ht as MembershipEvent, ot as DirectoryEvent, rt as DecisionEvent, tt as CredentialEvent } from "../policy-CFZAr_Al.js";
-import { f as ApprovalStore } from "../types-vKyAMtcX.js";
-import { n as CatalogEventData, o as CloudEventType } from "../sink-Gs6TTVa-.js";
-import { a as JsonWebKeySet, g as ReplayStore } from "../types-9AWO9EGt.js";
+import { $ as AccessEvent, At as SnapshotSource, Ft as TokenVerifier, Nt as TokenFailureCause, at as DecisionSink, bn as PolicySource, ht as MembershipEvent, ot as DirectoryEvent, rt as DecisionEvent, tt as CredentialEvent } from "../policy-IB6yxpC3.js";
+import { f as ApprovalStore } from "../types-aqOHTHcp.js";
+import { n as CatalogEventData, o as CloudEventType } from "../sink-B1fZzIMf.js";
+import { a as JsonWebKeySet, g as ReplayStore } from "../types-Cq_H8N_X.js";
 //#region src/cloud/types.d.ts
 type CloudEndpointOptions = {
   readonly url?: string;

package/dist/{cloud-BGhHS-lY.js → cloud-CB_ELYuX.js}

@@ -1,4 +1,4 @@
-import { i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-DWOrSQic.js";
+import { i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-DSxCqG9A.js";
 import { defineCommand } from "citty";
 //#region src/cli/commands/cloud.ts
 function cloud(ctx) {
@@ -30,7 +30,7 @@ function cloud(ctx) {
 			}
 		},
 		async run({ args: parsed }) {
-			const result = await (await import("./cloud-Bo3e9Ak3.js")).runCloud({
+			const result = await (await import("./cloud-DWLXO2af.js")).runCloud({
 				cwd: ctx.cwd,
 				config: ctx.config,
 				rest: parsed._,

package/dist/{cloud-Bo3e9Ak3.js → cloud-DWLXO2af.js}

@@ -1,9 +1,9 @@
-import { t as catalogFingerprint } from "./src-CSbUiozF.js";
-import { s as snapshotScopes } from "./permdock-CzqXjCpU.js";
+import { t as catalogFingerprint } from "./src-BDwEZWrZ.js";
+import { s as snapshotScopes } from "./permdock-CbgvLnuo.js";
 import { i as describeError } from "./errors-CWfoNg9N.js";
 import { i as loadConfiguredPolicy } from "./load-DhWEB9P1.js";
 import { t as parseCatalog } from "./parse-BuyjxhZV.js";
-import { t as runCatalog } from "./catalog-z8q6bi_r.js";
+import { t as runCatalog } from "./catalog-DWF5cYqB.js";
 //#region src/cli/cloud.ts
 function firstNonEmpty(...values) {
 	for (const value of values) if (value !== void 0 && value !== "") return value;

package/dist/{collect-DLlujdHC.js → collect-DClJsheJ.js}

@@ -1,5 +1,5 @@
 import { i as describeError } from "./errors-CWfoNg9N.js";
-import { a as listArg, i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-DWOrSQic.js";
+import { a as listArg, i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-DSxCqG9A.js";
 import { defineCommand } from "citty";
 //#region src/cli/commands/collect.ts
 function collect(ctx) {
@@ -44,7 +44,7 @@ function collect(ctx) {
 					});
 					return;
 				}
-				const { createCollectScheduler } = await import("./watch-Etoa_Mvr.js");
+				const { createCollectScheduler } = await import("./watch-BwxLTYMZ.js");
 				const scheduler = createCollectScheduler(ctx.cwd, { collect: overrides }, {
 					...ctx.configFile === void 0 ? {} : { configFile: ctx.configFile },
 					report: (message) => {
@@ -64,7 +64,7 @@ function collect(ctx) {
 				});
 				return;
 			}
-			const result = await (await import("./collect-rG2IQ3t0.js")).runCollect({
+			const result = await (await import("./collect-DSWOk19R.js")).runCollect({
 				cwd: ctx.cwd,
 				config: ctx.config,
 				collect: overrides,

package/dist/{collect-DDDv_ESs.js → collect-DSTE3ml9.js}

@@ -1,5 +1,5 @@
 import { i as describeError } from "./errors-CWfoNg9N.js";
-import { i as formatCatalogJson, n as catalogForCompare, t as buildCatalog } from "./catalog-doc-Dsc9y7sd.js";
+import { i as formatCatalogJson, n as catalogForCompare, t as buildCatalog } from "./catalog-doc-DdGm82XT.js";
 import { t as catalogPath } from "./catalog-path-CnI0XTFK.js";
 import { i as rel, r as listSourceFiles, t as defaultSrcPath } from "./files-DWUN9PzI.js";
 import { a as loadModule, i as loadConfiguredPolicy, o as pickNamed, r as leavesOf, t as asPermissionTree } from "./load-DhWEB9P1.js";

package/dist/collect-DSWOk19R.js

@@ -0,0 +1,2 @@
+import { r as runCollect } from "./collect-DSTE3ml9.js";
+export { runCollect };

package/dist/{commands-DWOrSQic.js → commands-DSxCqG9A.js}

@@ -76,19 +76,19 @@ const COMMAND_DESCRIPTIONS = {
 };
 /** Every top-level command, loaded only when it runs or its own `--help` is asked for. */
 const commands = {
-	collect: async () => (await import("./collect-DLlujdHC.js")).collect,
-	catalog: async () => (await import("./catalog-h2tlKFkq.js")).catalog,
-	diff: async () => (await import("./diff-CzqLxZ77.js")).diff,
-	usage: async () => (await import("./usage-D07N9QJ3.js")).usage,
-	doctor: async () => (await import("./doctor-rOr-4ZfS.js")).doctor,
-	config: async () => (await import("./config-Bn00Z3ks.js")).config,
-	skills: async () => (await import("./skills-JaymNCdK.js")).skills,
-	openapi: async () => (await import("./openapi-Bbg4wGVL.js")).openapi,
-	rls: async () => (await import("./rls-CEvs64Kj.js")).rls,
-	arazzo: async () => (await import("./arazzo-cmvX2jDe.js")).arazzo,
-	cloud: async () => (await import("./cloud-BGhHS-lY.js")).cloud,
-	supabase: async () => (await import("./supabase-CwafwxxF.js")).supabase,
-	powersync: async () => (await import("./powersync-yW1UUFzp.js")).powersync
+	collect: async () => (await import("./collect-DClJsheJ.js")).collect,
+	catalog: async () => (await import("./catalog-dFZdWCGN.js")).catalog,
+	diff: async () => (await import("./diff-DBIhz_f2.js")).diff,
+	usage: async () => (await import("./usage-GTixvDDU.js")).usage,
+	doctor: async () => (await import("./doctor-BwCAMLx_.js")).doctor,
+	config: async () => (await import("./config-Dnszbv-6.js")).config,
+	skills: async () => (await import("./skills-Bx-U0irG.js")).skills,
+	openapi: async () => (await import("./openapi-l0xYHkcv.js")).openapi,
+	rls: async () => (await import("./rls-B4ur8nKQ.js")).rls,
+	arazzo: async () => (await import("./arazzo-CKwwqFWz.js")).arazzo,
+	cloud: async () => (await import("./cloud-CB_ELYuX.js")).cloud,
+	supabase: async () => (await import("./supabase-Boqb9a_Y.js")).supabase,
+	powersync: async () => (await import("./powersync-DliZK_-y.js")).powersync
 };
 function isCommand(name) {
 	return Object.hasOwn(commands, name);

package/dist/compile/index.d.ts

@@ -1,3 +1,3 @@
 import { n as GraphSqlPart, r as RelationsMapping, t as GraphSql } from "../graph-sql-B-dsAT6j.js";
-import { a as CompiledWhere, c as compileWhere, i as CompiledSql, l as escapeLike, n as CompiledCompare, o as MembershipTable, r as CompiledExists, s as MembershipsMapping, t as CompileWhereOptions } from "../compile-CNnl6uIt.js";
+import { a as CompiledWhere, c as compileWhere, i as CompiledSql, l as escapeLike, n as CompiledCompare, o as MembershipTable, r as CompiledExists, s as MembershipsMapping, t as CompileWhereOptions } from "../compile-BkRyBDBw.js";
 export { type CompileWhereOptions, type CompiledCompare, type CompiledExists, type CompiledSql, type CompiledWhere, type GraphSql, type GraphSqlPart, type MembershipTable, type MembershipsMapping, type RelationsMapping, compileWhere, escapeLike };

package/dist/{compile-CNnl6uIt.d.ts → compile-BkRyBDBw.d.ts}

@@ -1,4 +1,4 @@
-import { Ir as Condition, Pr as Subject, br as Scope, mn as WhereResult } from "./policy-CFZAr_Al.js";
+import { Ir as Condition, Pr as Subject, br as Scope, mn as WhereResult } from "./policy-IB6yxpC3.js";
 import { y as ResourceNode } from "./permissions-DttnqqxC.js";
 import { r as RelationsMapping, t as GraphSql } from "./graph-sql-B-dsAT6j.js";
 //#region src/conditions/compile.d.ts

package/dist/{config-Bn00Z3ks.js → config-Dnszbv-6.js}

@@ -1,4 +1,4 @@
-import { i as globalArgs, t as COMMAND_DESCRIPTIONS } from "./commands-DWOrSQic.js";
+import { i as globalArgs, t as COMMAND_DESCRIPTIONS } from "./commands-DSxCqG9A.js";
 import { defineCommand } from "citty";
 //#region src/cli/commands/config.ts
 function config(ctx) {
@@ -19,7 +19,7 @@ function config(ctx) {
 			}
 		},
 		async run({ args: parsed }) {
-			const { runConfig } = await import("./config-report-Dw_JcUqT.js");
+			const { runConfig } = await import("./config-report-DMvWKUxL.js");
 			ctx.report(runConfig({
 				cwd: ctx.cwd,
 				config: ctx.config,

package/dist/{config-report-Dw_JcUqT.js → config-report-DMvWKUxL.js}

@@ -1,10 +1,10 @@
 import { n as CONFIG_REPORT_SCHEMA } from "./version-BvacVTZR.js";
 import { t as catalogPath } from "./catalog-path-CnI0XTFK.js";
 import { i as rel, t as defaultSrcPath } from "./files-DWUN9PzI.js";
-import { n as guessPermissions, t as barrelFile } from "./collect-DDDv_ESs.js";
-import "./sources-B0UvrJ21.js";
-import { r as MIGRATION_DIRS } from "./supabase-config-Bs44dare.js";
-import { t as DEFAULT_SENSITIVE_ACTIONS } from "./doctor-collect-ByfYlNv1.js";
+import { n as guessPermissions, t as barrelFile } from "./collect-DSTE3ml9.js";
+import "./sources-4p0-4xQm.js";
+import { r as MIGRATION_DIRS } from "./supabase-config-BpPXt3x1.js";
+import { t as DEFAULT_SENSITIVE_ACTIONS } from "./doctor-collect-CHk6XWOA.js";
 //#region src/cli/config-report.ts
 function configReport(input) {
 	const { cwd, config } = input;

package/dist/{context-Ttp0ekMT.js → context-Bcy85rGi.js}

@@ -1,6 +1,6 @@
 import { t as compact } from "./compact-y6vfu2_f.js";
-import { i as isPromiseLike } from "./store-options-yO0V6gRn.js";
-import { n as switchTenant, t as providerStore } from "./provider-store-DNyC1y48.js";
+import { i as isPromiseLike } from "./store-options-ByhZq1jV.js";
+import { n as switchTenant, t as providerStore } from "./provider-store-Cfbvo4DE.js";
 import { getContext, onDestroy, setContext } from "svelte";
 import { toStore } from "svelte/store";
 //#region src/svelte/context.ts