permdock 0.3.1 → 0.4.0

package/dist/{catalog-doc-DdGm82XT.js → catalog-doc-DWtg0gGR.js}

@@ -1,11 +1,11 @@
-import { _ as listPermissions, a as formerKeys, c as getResource } from "./permissions-DVoF6dMt.js";
-import { t as catalogFingerprint } from "./src-BDwEZWrZ.js";
-import { S as findRole } from "./grantee-Cv5Sogfv.js";
-import { t as canonicalJson } from "./canonical-json-DemiK4Vp.js";
+import { t as catalogFingerprint } from "./src-Bb7no-hS.js";
+import { a as getResource, c as listPermissions, h as formerKeys } from "./permission-registry-BsblpB-z.js";
+import { m as findRole } from "./grantee-CXY-0C87.js";
+import { t as canonicalJson } from "./canonical-json-CFKyFOke.js";
 import { t as byCodePoint } from "./compare-pfyVnBjE.js";
-import { t as catalogSchema } from "./schema-D3MnDMxa.js";
+import { t as catalogSchema } from "./schema-DjQBcAP9.js";
 import { t as policyRowConditionKeys } from "./row-conditions-h2HythXQ.js";
-import { s as generatorBanner, t as CATALOG_SCHEMA } from "./version-BvacVTZR.js";
+import { s as generatorBanner, t as CATALOG_SCHEMA } from "./version-BEogC-rB.js";
 //#region src/cli/catalog-doc.ts
 function leafLevels(tree, leaf) {
 	if (leaf.kind !== "instance") return;
@@ -27,7 +27,8 @@ function buildCatalog(tree, scan, generatedAt, policy) {
 			relations: node?.relations,
 			version: node?.version,
 			restricted: node?.restricted,
-			restrictedStops: node?.restrictedStops
+			restrictedStops: node?.restrictedStops,
+			meta: node?.meta
 		} : {
 			id: node?.id ?? "id",
 			schema: node === void 0 ? null : jsonSchemaOf(node),
@@ -35,7 +36,8 @@ function buildCatalog(tree, scan, generatedAt, policy) {
 			relations: node?.relations,
 			version: node?.version,
 			restricted: node?.restricted,
-			restrictedStops: node?.restrictedStops
+			restrictedStops: node?.restrictedStops,
+			meta: node?.meta
 		});
 	}
 	const approvals = codeApprovals(policy);
@@ -119,7 +121,8 @@ function catalogGrant(grant) {
 			purpose: grant.purpose,
 			requires: grant.requires?.length === 1 ? grant.requires[0] : grant.requires,
 			limit,
-			portable: grant.portable ? void 0 : false
+			portable: grant.portable ? void 0 : false,
+			meta: nonEmpty(grant.meta)
 		})
 	};
 }
@@ -240,10 +243,14 @@ function compactResource(resource) {
 			relations,
 			version: resource.version,
 			restricted: resource.restricted,
-			restrictedStops: resource.restrictedStops
+			restrictedStops: resource.restrictedStops,
+			meta: nonEmpty(resource.meta)
 		})
 	};
 }
+function nonEmpty(meta) {
+	return meta === void 0 || Object.keys(meta).length === 0 ? void 0 : { ...meta };
+}
 function metaRecord(meta) {
 	return { ...meta };
 }

package/dist/{catalog-DWF5cYqB.js → catalog-tZUyOfOv.js}

@@ -1,7 +1,7 @@
-import { a as formatCatalogMarkdown, i as formatCatalogJson, r as catalogSchemaDocument, t as buildCatalog } from "./catalog-doc-DdGm82XT.js";
-import { r as listSourceFiles, t as defaultSrcPath } from "./files-DWUN9PzI.js";
-import { a as loadModule, i as loadConfiguredPolicy, o as pickNamed, r as leavesOf, t as asPermissionTree } from "./load-DhWEB9P1.js";
-import { i as scanSources, r as runCollect } from "./collect-DSTE3ml9.js";
+import { r as listSourceFiles, t as defaultSrcPath } from "./files-D_JIzUrP.js";
+import { a as formatCatalogMarkdown, i as formatCatalogJson, r as catalogSchemaDocument, t as buildCatalog } from "./catalog-doc-DWtg0gGR.js";
+import { a as loadModule, i as loadConfiguredPolicy, r as leavesOf, s as pickNamed, t as asPermissionTree } from "./load-C3_oTHyO.js";
+import { i as scanSources, r as runCollect } from "./collect-2SrB7lfk.js";
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 //#region src/cli/catalog.ts

package/dist/claude-agent/index.d.ts

@@ -1,7 +1,7 @@
-import { C as Policy, D as PolicyVocabulary, Nr as Principal, kr as Delegation, ln as PermDock } from "../policy-IB6yxpC3.js";
-import { f as ApprovalStore } from "../types-aqOHTHcp.js";
-import { t as InstanceOptions } from "../instance-options-jARdwfPN.js";
-import { t as ToolMap } from "../types-Bvc4oWT6.js";
+import { E as Policy, Or as Principal, j as PolicyVocabulary, jt as PermDock, wr as Delegation } from "../policy-types-sp9P1iIV.js";
+import { f as ApprovalStore } from "../types-Br9IXUBG.js";
+import { t as InstanceOptions } from "../instance-options-plkrsAog.js";
+import { t as ToolMap } from "../types-DvupZE0w.js";
 //#region src/claude-agent/create.d.ts
 /** Structural `McpServerProvenance` from `@anthropic-ai/claude-agent-sdk`. */
 type ClaudeMcpServer = {

package/dist/claude-agent/index.js

@@ -1,11 +1,10 @@
-import { t as compact } from "../compact-y6vfu2_f.js";
-import { t as instanceOptions } from "../instance-options-Dhhcnm3y.js";
-import { n as createAgentKernel } from "../kernel-_RRHmnMY.js";
+import { r as isRecord, t as compact } from "../compact-CAf557ZB.js";
+import { r as instanceOptions } from "../build-instance-DIIV9DbC.js";
+import { n as createAgentKernel } from "../kernel-CB3LrIJM.js";
 //#region src/claude-agent/create.ts
 const MCP_PREFIX = "mcp__";
 function asInput(input) {
-	if (input !== null && typeof input === "object" && !Array.isArray(input)) return input;
-	return {};
+	return isRecord(input) ? input : {};
 }
 function untrustedServer(context, sources) {
 	if (!context.toolName.startsWith(MCP_PREFIX)) return;

package/dist/clerk/index.d.ts

@@ -1,6 +1,6 @@
-import { Nr as Principal, Pr as Subject, xt as RoleSource } from "../policy-IB6yxpC3.js";
-import { f as Permission } from "../permissions-DttnqqxC.js";
-import { s as RemotePdpCache } from "../types-DxiCGmmd.js";
+import { Or as Principal, kr as Subject, nt as RoleSource } from "../policy-types-sp9P1iIV.js";
+import { d as Permission } from "../permission-types-Dg39z9Kv.js";
+import { s as RemotePdpCache } from "../types-CIlTojhq.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/clerk/types.d.ts
 type ClerkPrincipal = Principal & {

package/dist/clerk/index.js

@@ -1,36 +1,16 @@
-import { t as compact } from "../compact-y6vfu2_f.js";
+import { i as omitKeys, r as isRecord, t as compact } from "../compact-CAf557ZB.js";
 import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
-import { t as ignoreRejection } from "../thenable-okc2xDsj.js";
+import { l as readPath, r as validateRecord } from "../thenable-QSmvt-vZ.js";
 import { t as anonymousSubject } from "../subject-C6dLxqHU.js";
-import { c as ttlMs, s as ttlCache } from "../shared-DRu8VFVM.js";
+import { c as ttlMs, s as ttlCache } from "../shared-JhMeOsDF.js";
 //#region src/clerk/subject.ts
-function isRecord(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
 function asRoles(value) {
 	if (typeof value === "string") return value === "" ? [] : [value];
 	if (!Array.isArray(value)) return [];
 	return value.filter((item) => typeof item === "string");
 }
-function readPath(record, path) {
-	let current = record;
-	for (const part of path.split(".")) {
-		if (!isRecord(current) || !Object.hasOwn(current, part)) return;
-		current = current[part];
-	}
-	return current;
-}
-function validateClaims(extra, schema) {
-	const result = schema["~standard"].validate(extra);
-	if (result instanceof Promise) {
-		ignoreRejection(result);
-		return;
-	}
-	if ("issues" in result && result.issues !== void 0) return;
-	const value = result.value;
-	return isRecord(value) ? value : void 0;
-}
-const REGISTERED_CLAIMS = /* @__PURE__ */ new Set([
+/** Registered claims plus `unsafeMetadata`, which the user can edit. */
+const NOT_EXTRA = /* @__PURE__ */ new Set([.../* @__PURE__ */ new Set([
 	"iss",
 	"sub",
 	"aud",
@@ -47,14 +27,9 @@ const REGISTERED_CLAIMS = /* @__PURE__ */ new Set([
 	"fea",
 	"o",
 	"v"
-]);
+]), "unsafeMetadata"]);
 function extraClaims(claims) {
-	const extra = {};
-	for (const [key, value] of Object.entries(claims)) {
-		if (REGISTERED_CLAIMS.has(key) || key === "unsafeMetadata") continue;
-		extra[key] = value;
-	}
-	return extra;
+	return omitKeys(claims, NOT_EXTRA);
 }
 /**
 * Plan slugs from `pla`, split by owner: `o:` plans belong to the session's
@@ -273,7 +248,7 @@ async function fromClerk(authObject, options, loadMemberships) {
 			return true;
 		})];
 		let claims = extraClaims(mapped.claims);
-		if (options.schema !== void 0) claims = validateClaims(claims, options.schema) ?? {};
+		if (options.schema !== void 0) claims = validateRecord(options.schema, claims) ?? {};
 		const global = [...globalRolesFrom(mapped.claims, options.globalRoles), ...features.user];
 		const exp = mapped.claims["exp"];
 		const principal = compact({

package/dist/cli/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { t as run } from "../run-BWc9qqvE.js";
+import { t as run } from "../run-DMcNW_8T.js";
 import { n as streamHasColors } from "../style-CTm1AXDT.js";
 //#region src/cli/bin.ts
 const result = await run(process.argv.slice(2), {

package/dist/cli/index.d.ts

@@ -1,5 +1,5 @@
-import { a as CatalogDocument, c as CatalogResource, d as CatalogSupportAccess, f as CatalogUsage, l as CatalogRole, n as CatalogApproval, r as CatalogBreakGlass, s as CatalogPermission, t as CatalogActivation, u as CatalogScope } from "../types-Dnemwd77.js";
-import { _ as RunResult, c as RlsConfig, d as RlsMembershipTable, f as RlsMemberships, g as RlsTarget, h as RlsSuspension, i as PermDockConfig, l as RlsDialect, m as RlsSuspendedScope, n as CliIo, o as RlsActiveRow, p as RlsSuspendedMembership, r as CollectConfig, s as RlsApiKeys, t as CatalogConfig, u as RlsFunctionMapping } from "../types-DbjRN55U.js";
+import { a as CatalogDocument, c as CatalogResource, d as CatalogSupportAccess, f as CatalogUsage, l as CatalogRole, n as CatalogApproval, r as CatalogBreakGlass, s as CatalogPermission, t as CatalogActivation, u as CatalogScope } from "../types-DpWfQdSh.js";
+import { _ as RunResult, c as RlsConfig, d as RlsMembershipTable, f as RlsMemberships, g as RlsTarget, h as RlsSuspension, i as PermDockConfig, l as RlsDialect, m as RlsSuspendedScope, n as CliIo, o as RlsActiveRow, p as RlsSuspendedMembership, r as CollectConfig, s as RlsApiKeys, t as CatalogConfig, u as RlsFunctionMapping } from "../types-7rJVLWe5.js";
 //#region src/cli/catalog-path.d.ts
 /**
  * The absolute path `permdock collect` writes the catalog to: `collect.out`,
@@ -11,7 +11,7 @@ export declare function catalogPath(config: PermDockConfig, cwd: string, out?: s
 //#region src/cli/config.d.ts
 export declare function defineConfig<T extends PermDockConfig>(config: T): T;
 //#endregion
-//#region src/cli/markers.d.ts
+//#region src/cli/sql/markers.d.ts
 /** The first line of a hook migration `permdock supabase hook generate` wrote. */
 type SupabaseHookMarker = {
   /** The marker's major: `1` for `-- permdock:hook v1`. */

package/dist/cli/index.js

@@ -1,5 +1,5 @@
 import { t as catalogPath } from "../catalog-path-CnI0XTFK.js";
-import { t as defineConfig } from "../config-BJiM-xAm.js";
-import { o as parseGrantsMarker, s as parseHookMarker } from "../markers-B0hYLvMD.js";
-import { t as run } from "../run-BWc9qqvE.js";
+import { t as defineConfig } from "../config-BIjREpyE.js";
+import { c as parseGrantsMarker, l as parseHookMarker } from "../markers-CiwAOZtO.js";
+import { t as run } from "../run-DMcNW_8T.js";
 export { catalogPath, defineConfig, parseGrantsMarker, parseHookMarker, run };

package/dist/cloud/index.d.ts

@@ -1,7 +1,7 @@
-import { $ as AccessEvent, At as SnapshotSource, Ft as TokenVerifier, Nt as TokenFailureCause, at as DecisionSink, bn as PolicySource, ht as MembershipEvent, ot as DirectoryEvent, rt as DecisionEvent, tt as CredentialEvent } from "../policy-IB6yxpC3.js";
-import { f as ApprovalStore } from "../types-aqOHTHcp.js";
-import { n as CatalogEventData, o as CloudEventType } from "../sink-B1fZzIMf.js";
-import { a as JsonWebKeySet, g as ReplayStore } from "../types-Cq_H8N_X.js";
+import { Cn as MembershipEvent, Ht as PolicySource, Sn as DirectoryEvent, W as DecisionSink, at as SnapshotSource, bn as CredentialEvent, ct as TokenFailureCause, ut as TokenVerifier, vn as AccessEvent, xn as DecisionEvent } from "../policy-types-sp9P1iIV.js";
+import { f as ApprovalStore } from "../types-Br9IXUBG.js";
+import { a as JsonWebKeySet, g as ReplayStore } from "../types-C0dee0Qf.js";
+import { n as CatalogEventData, o as CloudEventType } from "../sink-CPN4zLfs.js";
 //#region src/cloud/types.d.ts
 type CloudEndpointOptions = {
   readonly url?: string;

package/dist/cloud/index.js

@@ -1,10 +1,10 @@
-import { t as compact } from "../compact-y6vfu2_f.js";
+import { r as isRecord, t as compact } from "../compact-CAf557ZB.js";
 import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
-import { T as isForbiddenKey } from "../permissions-DVoF6dMt.js";
-import { i as parsePolicyDocument } from "../hosted-DJQw46hn.js";
-import { t as CLOUD_EVENT_TYPES } from "../sink-Bd9PSyfq.js";
+import { o as isForbiddenKey } from "../thenable-QSmvt-vZ.js";
+import { i as parsePolicyDocument } from "../hosted-CBHgkzDl.js";
+import { t as CLOUD_EVENT_TYPES } from "../sink-BTtmfPnE.js";
 import { r as isApprovalErrorCode, t as ApprovalError } from "../errors-DRnGZHzF.js";
-import { t as joseTokenVerifier } from "../verifier-BxBo6I44.js";
+import { t as joseTokenVerifier } from "../verifier-DMr_Zmb_.js";
 import { t as timeoutSignal } from "../timeout-D51niuQP.js";
 //#region src/cloud/create.ts
 /** Milliseconds a PermDock Cloud request may take; a slower one fails like an unreachable Cloud. */
@@ -20,11 +20,8 @@ function firstNonEmpty(...values) {
 function trimSlash(value) {
 	return value.endsWith("/") ? value.slice(0, -1) : value;
 }
-function isRecord$1(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
 function asApproval(value) {
-	if (!isRecord$1(value) || value["v"] !== 1 || typeof value["token"] !== "string") return null;
+	if (!isRecord(value) || value["v"] !== 1 || typeof value["token"] !== "string") return null;
 	return value;
 }
 function isCompactJws$1(value) {
@@ -138,7 +135,7 @@ function cloud(options = {}) {
 				const response = await request(`/approvals${suffix}`);
 				if (!response.ok) return { items: [] };
 				const body = await response.json();
-				if (!isRecord$1(body) || !Array.isArray(body["items"])) return { items: [] };
+				if (!isRecord(body) || !Array.isArray(body["items"])) return { items: [] };
 				const items = body["items"].flatMap((item) => {
 					const parsed = asApproval(item);
 					return parsed === null ? [] : [parsed];
@@ -162,7 +159,7 @@ function cloud(options = {}) {
 			});
 			if (!response.ok) throw new Error("PermDock Cloud rejected the approval cancel");
 			const body = await response.json();
-			if (!isRecord$1(body) || typeof body["cancelled"] !== "number") throw new Error("PermDock Cloud returned an unknown cancel shape");
+			if (!isRecord(body) || typeof body["cancelled"] !== "number") throw new Error("PermDock Cloud returned an unknown cancel shape");
 			return body["cancelled"];
 		},
 		async expire(now) {
@@ -173,7 +170,7 @@ function cloud(options = {}) {
 				});
 				if (!response.ok) return 0;
 				const body = await response.json();
-				if (!isRecord$1(body) || typeof body["expired"] !== "number") return 0;
+				if (!isRecord(body) || typeof body["expired"] !== "number") return 0;
 				return body["expired"];
 			} catch {
 				return 0;
@@ -261,9 +258,6 @@ function cloud(options = {}) {
 //#endregion
 //#region src/cloud/webhook.ts
 const TYPES = new Set(Object.values(CLOUD_EVENT_TYPES));
-function isRecord(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
 function hasUnsafeKey(value) {
 	if (Array.isArray(value)) return value.some(hasUnsafeKey);
 	if (!isRecord(value)) return false;

package/dist/{cloud-CfwZ39Rl.js → cloud-C7bSDgX4.js}

@@ -1,4 +1,4 @@
-import { i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-BeaGNj_o.js";
+import { i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-Cpip4ULx.js";
 import { defineCommand } from "citty";
 //#region src/cli/commands/cloud.ts
 function cloud(ctx) {
@@ -30,7 +30,7 @@ function cloud(ctx) {
 			}
 		},
 		async run({ args: parsed }) {
-			const result = await (await import("./cloud-DWLXO2af.js")).runCloud({
+			const result = await (await import("./cloud-PeBN3IEn.js")).runCloud({
 				cwd: ctx.cwd,
 				config: ctx.config,
 				rest: parsed._,

package/dist/{cloud-DWLXO2af.js → cloud-PeBN3IEn.js}

@@ -1,9 +1,9 @@
-import { t as catalogFingerprint } from "./src-BDwEZWrZ.js";
-import { s as snapshotScopes } from "./permdock-CbgvLnuo.js";
+import { t as catalogFingerprint } from "./src-Bb7no-hS.js";
+import { s as snapshotScopes } from "./permdock-L26udHSk.js";
 import { i as describeError } from "./errors-CWfoNg9N.js";
-import { i as loadConfiguredPolicy } from "./load-DhWEB9P1.js";
-import { t as parseCatalog } from "./parse-BuyjxhZV.js";
-import { t as runCatalog } from "./catalog-DWF5cYqB.js";
+import { i as loadConfiguredPolicy } from "./load-C3_oTHyO.js";
+import { t as parseCatalog } from "./parse-CVFQHk6c.js";
+import { t as runCatalog } from "./catalog-tZUyOfOv.js";
 //#region src/cli/cloud.ts
 function firstNonEmpty(...values) {
 	for (const value of values) if (value !== void 0 && value !== "") return value;

package/dist/{collect-DSTE3ml9.js → collect-2SrB7lfk.js}

@@ -1,10 +1,10 @@
 import { i as describeError } from "./errors-CWfoNg9N.js";
-import { i as formatCatalogJson, n as catalogForCompare, t as buildCatalog } from "./catalog-doc-DdGm82XT.js";
+import { a as rel, r as listSourceFiles, s as writeFileEnsuringDir, t as defaultSrcPath } from "./files-D_JIzUrP.js";
+import { i as formatCatalogJson, n as catalogForCompare, t as buildCatalog } from "./catalog-doc-DWtg0gGR.js";
 import { t as catalogPath } from "./catalog-path-CnI0XTFK.js";
-import { i as rel, r as listSourceFiles, t as defaultSrcPath } from "./files-DWUN9PzI.js";
-import { a as loadModule, i as loadConfiguredPolicy, o as pickNamed, r as leavesOf, t as asPermissionTree } from "./load-DhWEB9P1.js";
+import { a as loadModule, i as loadConfiguredPolicy, r as leavesOf, s as pickNamed, t as asPermissionTree } from "./load-C3_oTHyO.js";
 import { t as shortDiff } from "./text-diff-BdkkYSbi.js";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 import { dirname, relative, resolve } from "node:path";
 import { Visitor, parseSync, visitorKeys } from "oxc-parser";
 //#region src/cli/scan.ts
@@ -455,8 +455,7 @@ async function runCollect(input) {
 			message: `catalog up to date: ${rel(input.cwd, outPath)}`
 		};
 	}
-	mkdirSync(dirname(outPath), { recursive: true });
-	writeFileSync(outPath, next);
+	writeFileEnsuringDir(outPath, next);
 	const written = [outPath];
 	const barrel = input.collect.barrel ?? input.config.collect?.barrel;
 	if (barrel !== void 0 && barrel !== false) {
@@ -495,8 +494,7 @@ import { permissions as collected } from '${specifier.startsWith(".") ? specifie
 
 export const permissions = mergePermissions(collected)
 `;
-	mkdirSync(dirname(abs), { recursive: true });
-	writeFileSync(abs, body);
+	writeFileEnsuringDir(abs, body);
 }
 //#endregion
 export { scanSources as i, guessPermissions as n, runCollect as r, barrelFile as t };

package/dist/collect-Bw2Jdq1q.js

@@ -0,0 +1,2 @@
+import { r as runCollect } from "./collect-2SrB7lfk.js";
+export { runCollect };

package/dist/{collect-CHB22Sx4.js → collect-CQx4hX4N.js}

@@ -1,5 +1,5 @@
 import { i as describeError } from "./errors-CWfoNg9N.js";
-import { a as listArg, i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-BeaGNj_o.js";
+import { a as listArg, i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-Cpip4ULx.js";
 import { defineCommand } from "citty";
 //#region src/cli/commands/collect.ts
 function collect(ctx) {
@@ -44,7 +44,7 @@ function collect(ctx) {
 					});
 					return;
 				}
-				const { createCollectScheduler } = await import("./watch-BwxLTYMZ.js");
+				const { createCollectScheduler } = await import("./watch-C8TpsAl4.js");
 				const scheduler = createCollectScheduler(ctx.cwd, { collect: overrides }, {
 					...ctx.configFile === void 0 ? {} : { configFile: ctx.configFile },
 					report: (message) => {
@@ -64,7 +64,7 @@ function collect(ctx) {
 				});
 				return;
 			}
-			const result = await (await import("./collect-DSWOk19R.js")).runCollect({
+			const result = await (await import("./collect-Bw2Jdq1q.js")).runCollect({
 				cwd: ctx.cwd,
 				config: ctx.config,
 				collect: overrides,

package/dist/{commands-BeaGNj_o.js → commands-Cpip4ULx.js}

@@ -76,19 +76,19 @@ const COMMAND_DESCRIPTIONS = {
 };
 /** Every top-level command, loaded only when it runs or its own `--help` is asked for. */
 const commands = {
-	collect: async () => (await import("./collect-CHB22Sx4.js")).collect,
-	catalog: async () => (await import("./catalog-CYj-mX2O.js")).catalog,
-	diff: async () => (await import("./diff-C9RDjjhs.js")).diff,
-	usage: async () => (await import("./usage-B0YuTQRO.js")).usage,
-	doctor: async () => (await import("./doctor-Djh6JDEk.js")).doctor,
-	config: async () => (await import("./config-ir40y8m0.js")).config,
-	skills: async () => (await import("./skills-C5CbhhpG.js")).skills,
-	openapi: async () => (await import("./openapi-CQTsgKoB.js")).openapi,
-	rls: async () => (await import("./rls-P-BeBx0n.js")).rls,
-	arazzo: async () => (await import("./arazzo-C9chp3ST.js")).arazzo,
-	cloud: async () => (await import("./cloud-CfwZ39Rl.js")).cloud,
-	supabase: async () => (await import("./supabase-s4o9s1O1.js")).supabase,
-	powersync: async () => (await import("./powersync-DE19b9dT.js")).powersync
+	collect: async () => (await import("./collect-CQx4hX4N.js")).collect,
+	catalog: async () => (await import("./catalog-WHG4kBq7.js")).catalog,
+	diff: async () => (await import("./diff-Cnghh_Ip.js")).diff,
+	usage: async () => (await import("./usage-4G6t643F.js")).usage,
+	doctor: async () => (await import("./doctor-CuVJvhV_.js")).doctor,
+	config: async () => (await import("./config-DLt6BvV7.js")).config,
+	skills: async () => (await import("./skills-Dle4ZoLF.js")).skills,
+	openapi: async () => (await import("./openapi-DcQ1Kg40.js")).openapi,
+	rls: async () => (await import("./rls-55DQTuf5.js")).rls,
+	arazzo: async () => (await import("./arazzo-CD8d0WLb.js")).arazzo,
+	cloud: async () => (await import("./cloud-C7bSDgX4.js")).cloud,
+	supabase: async () => (await import("./supabase-Dbqr141s.js")).supabase,
+	powersync: async () => (await import("./powersync-BFSbSElQ.js")).powersync
 };
 function isCommand(name) {
 	return Object.hasOwn(commands, name);

package/dist/{compact-y6vfu2_f.js → compact-CAf557ZB.js}

@@ -15,5 +15,15 @@ function isReadonlyArray(value) {
 function sole(items) {
 	return items.length === 1 ? items[0] : void 0;
 }
+/** A plain object: not `null` and not an array. */
+function isRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+/** The own entries of `record` whose key is not in `reserved`. */
+function omitKeys(record, reserved) {
+	const out = {};
+	for (const [key, value] of Object.entries(record)) if (!reserved.has(key)) out[key] = value;
+	return out;
+}
 //#endregion
-export { isReadonlyArray as n, sole as r, compact as t };
+export { sole as a, omitKeys as i, isReadonlyArray as n, isRecord as r, compact as t };

package/dist/compile/index.d.ts

@@ -1,3 +1,3 @@
 import { n as GraphSqlPart, r as RelationsMapping, t as GraphSql } from "../graph-sql-B-dsAT6j.js";
-import { a as CompiledWhere, c as compileWhere, i as CompiledSql, l as escapeLike, n as CompiledCompare, o as MembershipTable, r as CompiledExists, s as MembershipsMapping, t as CompileWhereOptions } from "../compile-BkRyBDBw.js";
+import { a as CompiledWhere, c as compileWhere, i as CompiledSql, l as escapeLike, n as CompiledCompare, o as MembershipTable, r as CompiledExists, s as MembershipsMapping, t as CompileWhereOptions } from "../compile-CtTP7eur.js";
 export { type CompileWhereOptions, type CompiledCompare, type CompiledExists, type CompiledSql, type CompiledWhere, type GraphSql, type GraphSqlPart, type MembershipTable, type MembershipsMapping, type RelationsMapping, compileWhere, escapeLike };

package/dist/compile/index.js

@@ -1,2 +1,2 @@
-import { n as escapeLike, t as compileWhere } from "../compile-Ba4blROR.js";
+import { n as escapeLike, t as compileWhere } from "../compile-CcEu2ZQ1.js";
 export { compileWhere, escapeLike };

package/dist/{compile-Ba4blROR.js → compile-CcEu2ZQ1.js}

@@ -1,9 +1,10 @@
-import { n as isReadonlyArray, r as sole, t as compact } from "./compact-y6vfu2_f.js";
-import { S as restrictedFor, d as isEdgeRelation, f as isFieldRelation, g as isSelfParented, l as groupEntries, m as isPrincipalRelation, r as expandRelation, w as assertSafeKey } from "./permissions-DVoF6dMt.js";
-import { c as isConditionRef, i as resolveConditionRef, s as isConditionDate, u as parentHop } from "./refs-KYb4ntaz.js";
-import { n as PermDockValidationError } from "./validation-error-CnjZ4t92.js";
+import { a as sole, n as isReadonlyArray, t as compact } from "./compact-CAf557ZB.js";
+import { a as assertSafeKey } from "./thenable-QSmvt-vZ.js";
+import { c as isConditionRef, i as resolveConditionRef, s as isConditionDate, u as parentHop } from "./refs-f3imMjNW.js";
+import { n as PermDockValidationError } from "./validation-error-ZfUHbKvf.js";
 import { t as expiredAt } from "./expiry-BoBJ8Tvc.js";
-import { c as rootScope, d as scopeList, l as scopeChain, m as tenantOf, o as resolveScope, p as subjectMemberships } from "./scopes-CVdPrWN-.js";
+import { c as rootScope, d as scopeList, l as scopeChain, m as tenantOf, o as resolveScope, p as subjectMemberships } from "./scopes-tvpa34ep.js";
+import { a as expandRelation, c as isEdgeRelation, d as isSelfParented, l as isFieldRelation, o as groupEntries, p as restrictedFor, u as isPrincipalRelation } from "./resource-relations-D1Un3pcz.js";
 //#region src/conditions/graph-sql.ts
 /** A Postgres identifier, schema-qualified names split on `.`. */
 function quoteSqlName(name) {

package/dist/{compile-BkRyBDBw.d.ts → compile-CtTP7eur.d.ts}

@@ -1,5 +1,5 @@
-import { Ir as Condition, Pr as Subject, br as Scope, mn as WhereResult } from "./policy-IB6yxpC3.js";
-import { y as ResourceNode } from "./permissions-DttnqqxC.js";
+import { It as WhereResult, hn as Scope, jr as Condition, kr as Subject } from "./policy-types-sp9P1iIV.js";
+import { y as ResourceNode } from "./permission-types-Dg39z9Kv.js";
 import { r as RelationsMapping, t as GraphSql } from "./graph-sql-B-dsAT6j.js";
 //#region src/conditions/compile.d.ts
 type MembershipTable = {

package/dist/{config-BJiM-xAm.js → config-BIjREpyE.js}

@@ -1,3 +1,4 @@
+import { r as isRecord } from "./compact-CAf557ZB.js";
 import { t as CliError } from "./errors-CWfoNg9N.js";
 import { existsSync } from "node:fs";
 import { relative, resolve } from "node:path";
@@ -33,6 +34,8 @@ const SECTIONS = {
 		authorize: true,
 		policyPerRole: true,
 		customRoles: true,
+		triggers: true,
+		audit: true,
 		capabilities: true,
 		anonymousSignIns: true,
 		fields: true,
@@ -81,9 +84,6 @@ const TOP_LEVEL = /* @__PURE__ */ new Set([
 	"policy",
 	...Object.keys(SECTIONS)
 ]);
-function isRecord(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
 function isSection(key) {
 	return Object.hasOwn(SECTIONS, key);
 }
@@ -141,7 +141,7 @@ async function readConfig(cwd, fromFlag, options) {
 		file: void 0
 	};
 	if (!existsSync(path)) throw new Error(`PermDock CLI: config file not found: ${path}`);
-	const { loadModule, pickNamed } = await import("./load-DwJUafYN.js");
+	const { loadModule, pickNamed } = await import("./load-B_shHrmd.js");
 	return {
 		...parseConfig(pickNamed(await loadModule(path, options), ["default"]), relative(cwd, path).replaceAll("\\", "/")),
 		file: path

package/dist/{config-ir40y8m0.js → config-DLt6BvV7.js}

@@ -1,4 +1,4 @@
-import { i as globalArgs, t as COMMAND_DESCRIPTIONS } from "./commands-BeaGNj_o.js";
+import { i as globalArgs, t as COMMAND_DESCRIPTIONS } from "./commands-Cpip4ULx.js";
 import { defineCommand } from "citty";
 //#region src/cli/commands/config.ts
 function config(ctx) {
@@ -19,7 +19,7 @@ function config(ctx) {
 			}
 		},
 		async run({ args: parsed }) {
-			const { runConfig } = await import("./config-report-CdCgbRnV.js");
+			const { runConfig } = await import("./config-report--Xb9APJS.js");
 			ctx.report(runConfig({
 				cwd: ctx.cwd,
 				config: ctx.config,

package/dist/{config-report-CdCgbRnV.js → config-report--Xb9APJS.js}

@@ -1,10 +1,9 @@
-import { n as CONFIG_REPORT_SCHEMA } from "./version-BvacVTZR.js";
+import { a as rel, t as defaultSrcPath } from "./files-D_JIzUrP.js";
+import { n as CONFIG_REPORT_SCHEMA } from "./version-BEogC-rB.js";
 import { t as catalogPath } from "./catalog-path-CnI0XTFK.js";
-import { i as rel, t as defaultSrcPath } from "./files-DWUN9PzI.js";
-import { n as guessPermissions, t as barrelFile } from "./collect-DSTE3ml9.js";
-import "./sources-4p0-4xQm.js";
-import { r as MIGRATION_DIRS } from "./supabase-config-Bj3iDH2I.js";
-import { t as DEFAULT_SENSITIVE_ACTIONS } from "./doctor-collect-CjdO0wQX.js";
+import { n as guessPermissions, t as barrelFile } from "./collect-2SrB7lfk.js";
+import "./sources-B1-b-R0t.js";
+import { n as MIGRATION_DIRS, t as DEFAULT_SENSITIVE_ACTIONS } from "./constants-DcJABbLW.js";
 //#region src/cli/config-report.ts
 function configReport(input) {
 	const { cwd, config } = input;

package/dist/{connection-CU8MQxRi.js → connection-DUsczpB5.js}

@@ -1,5 +1,5 @@
-import { t as compact } from "./compact-y6vfu2_f.js";
-import { r as PermDockRevokedError } from "./errors-Cz5zn0mW.js";
+import { t as compact } from "./compact-CAf557ZB.js";
+import { r as PermDockRevokedError } from "./errors-drnfxYtm.js";
 //#region src/server/connection.ts
 /** `setTimeout` stores delays in a signed 32-bit integer. */
 const MAX_DELAY = 2147483647;
@@ -184,6 +184,7 @@ async function openConnection(input) {
 			const permdock = live();
 			return permdock === void 0 ? [] : permdock.filter(permission, items, decideOptions);
 		},
+		settled: () => chain,
 		close() {
 			closed = true;
 			clear();

package/dist/constants-DcJABbLW.js

@@ -0,0 +1,20 @@
+//#region src/cli/shared/constants.ts
+const DEFAULT_SENSITIVE_ACTIONS = [
+	"approve",
+	"pay",
+	"settle",
+	"submit",
+	"transfer",
+	"refund",
+	"disburse"
+];
+const MIGRATION_DIRS = [
+	"supabase/migrations",
+	"supabase/schemas",
+	"migrations",
+	"drizzle",
+	"prisma/migrations",
+	"db/migrations"
+];
+//#endregion
+export { MIGRATION_DIRS as n, DEFAULT_SENSITIVE_ACTIONS as t };